Well, this was one way to make Halloween even scarier!

Last week, on October 29, Binance suffered what is now the biggest crypto hack in history, with approximately $6.34 billion worth of crypto stolen in about just half an hour… OUCH!

So, how did hackers pull this off, and what’s the current situation?

Billions stolen but billions frozen

The attack affected Binance wallets across 10 blockchains, including Bitcoin, Ethereum, Solana and Tron, stealing 18,270 BTC, nearly 200,000 ETH and billions in stablecoins.

This made it quite broad, but the crypto ecosystem didn’t just sit back and watch it happen. Tether, Circle, Ripple and other industry players quickly acted and started freezing assets they had issued or could help intercept, accounting for about $2.85 billion of the stolen funds.

As transactions are publicly visible on the blockchain, investigators can follow the money and identify suspicious wallets. So when a centralised issuer has the ability to freeze tokens, it may stop stolen funds from moving further. That’s exactly what happens.

However, the remaining funds are much harder to intercept, as hackers have been moving them through thousands of wallets and more than 40,000 transactions to cover their tracks.

According to blockchain investigators, this massive money-laundering operation could take months, if not years, and there’s no guarantee the money will ever be completely recovered.

How did it happen?

Well, probably not how you think…

Hackers didn’t steal Binance’s private keys, but actually got the systems to approve their fraudulent transactions. How? Huuuh… they tricked some employees from the company into giving them access to its systems (not on purpose of course).

They prepared their coup for quite some time. According to Binance’s initial findings, it started months earlier, in June, when the hackers compromised an engineer’s computer through a malicious software disguised as a legitimate developer tool. The company detected suspicious activity, replaced the device and changed credentials, but the attackers already had a step in.

Then, they went further in September by using fake job interviews and coding assignments, containing malicious software again, to infect another employee’s computer. By October 20, they had managed to use their access to move deeper into Binance’s internal systems.

That was the bingo! On October 29, the attackers exploited this access and managed to get the systems to approve transactions worth billions… Here comes the money!

This approach is a great example of hackers relying on social engineering to gain access and steal funds. And there are signs that can reveal such attempts, which is why companies need to train employees to recognise suspicious requests and keep their devices and software secure.

Who’s behind it?

Sorry, we’re not going to be original here, as all fingers, and even the FBI, point to North Korea once again, attributing the attack to the infamous TraderTraitor hacking group (linked to the Lazarus Group).

As we shared a few weeks ago, the group has also been linked to the $1.5 billion Bybit hack in February 2025, which, by the way, was the previous biggest crypto hack in history. It seems like they appreciate breaking their own records.

The FBI confirmed North Korea’s responsibility on October 31, warning that the stolen assets were being converted mainly into Ethereum, with further laundering expected through decentralised finance (DeFi) services and swap platforms.

And yes, as you can imagine, stolen crypto appears to be a major source of funding for the North Korean regime, as the Cybercrime became a way to generate money while bypassing international sanctions...

What’s the situation now?

Despite the crazy, enormous, gigantic, monstrous (I’ll stop here) damage, Binance has promised to cover all losses using its own resources, through its SAFU emergency fund, which was specifically created to protect users in situations like this.

According to Binance’s November 3 update, 98% of the affected assets had already been replenished as of October 31, with the remaining and harder-to-source assets being purchased. The company also said it had set aside more than enough funds to cover the losses, so users wouldn’t bear the financial impact.

As shared publicly by its Co-CEO, Binance has also rebuilt affected systems, strengthened its security measures, and brought in independent cybersecurity experts.

On the bright side of things, this incident showed once again how quickly the industry can come together when things go south and how important it is for serious companies to be prepared for such situations.

In any case, hackers are getting smarter, but the ecosystem is keeping up!

This is one of the reasons why strict regulations are being implemented, such as MiCA in the European Union, which, among many other things, aims to improve security and protection for the end users.

As of today, Binance still hasn’t obtained its MiCA licence, after withdrawing its application in Greece and announcing plans to pursue authorisation elsewhere in the EU… But Venga did (just saying)!

Hacks Are Not a Crypto Thing

This Binance hack, has taken first place among the biggest crypto heists in history, and by quite a margin. However, if you think hacks are reserved for the crypto industry, you’d be wrong, as the traditional banking system is also a target for hackers.

The International Monetary Fund (IMF) found that almost 20% of reported cyber incidents over the past two decades affected the financial sector, during which banks were the most frequent targets, followed by insurers and asset managers.

And we just got a fresh example this week with Crédit Mutuel Arkéa in France, which confirmed on Wednesday that a cyberattack involving a service provider allowed hackers to access an account belonging to the bank and execute fraudulent transactions. The bank assured that customers were not affected.

According to the bank, the attackers gained control over part of its euro funds, transferred them to external platforms, where they converted the money into crypto assets.

This large movement of funds attracted the attention of ZachXBT (yes, our Crypto Sherlock again), who investigated the transactions over several days and identified Crédit Mutuel Arkéa as the victim of a theft estimated at more than $133 million. Ouch again!

This figure comes from ZachXBT’s own on-chain investigation, which he shared on his Telegram channel. However, the bank has not officially confirmed that exact amount, and even ZachXBT also suspects the final figure is larger once over-the-counter (OTC) trades are counted.

The “fun” fact about this attack (if there can be one) is that the movement and conversion of the funds into crypto allowed them to be noticed and traced by the crypto community, with investigators raising the alarm days before the bank confirmed the incident.

In any case, the increasing number of recent hacks and overall cyberattacks is a global and general issue. It’s not reserved for a specific sector.

Disclaimer: The content provided in this article is for educational and informational purposes only and should not be considered financial or investment advice. Interacting with blockchain, crypto assets, and Web3 applications involves risks, including the potential loss of funds. Venga encourages readers to conduct thorough research and understand the risks before engaging with any crypto assets or blockchain technologies. For more details, please refer to our terms of service.

When buying crypto, most people do not think that the geographical location would affect how their assets are treated. 

Across the EU, a single, unified framework sets clear standards upfront for custody, disclosures, and platform operations, while in the U.S., investor protection is largely shaped through state-by-state licensing and federal court enforcement.

We will look at a breakdown of how both approaches work and what kind of protection you actually get on each side of the Atlantic.

EU vs. U.S. Crypto User Protection: How the Frameworks Differ

The EU operates under a single, harmonised crypto framework built primarily around the Markets in Crypto-Assets Regulation (MiCA). This is reinforced by specialized legislation like DORA (the Digital Operational Resilience Act), which sets strict IT security and cyber standards, and the recast Transfer of Funds Regulation (TFR), which traces crypto transactions for anti-money laundering compliance.

By contrast, user protection in the U.S. does not come from a single crypto rulebook. Instead, the rights and safeguards you receive depend heavily on four moving pieces:

• The type of crypto-asset: Whether a token is treated as a security, commodity, or payment tool.
• The Activity: What you are doing: spot buying, staking, lending, or trading derivatives.
• The Provider: How the platform is chartered, registered, or licensed to hold assets.
• The Jurisdiction: Whether oversight falls under federal regulators (like the SEC and CFTC) or state rules (like New York's BitLicense).

Why Is the EU–U.S. Comparison Not One-to-One?

Comparing EU and U.S. crypto protections is not simply a matter of comparing two regulatory frameworks with different requirements. The EU takes a more unified, comprehensive approach, while the U.S. relies on a combination of federal agencies, state regulators, and local laws.

In the EU, the approach was architectural. Lawmakers sat down to build a tailored system from scratch. Through MiCA, the EU established a single set of harmonised rules defining specific categories of crypto-assets (such as asset-referenced tokens, e-money tokens, and utility tokens) alongside clear obligations for Crypto-Asset Service Providers (CASPs). 

Once an entity complies with MiCA in one EU Member State, those exact same rights and operational baselines carry across all 27 borders.

The U.S. took the opposite route. Instead of one comprehensive crypto law, protection is distributed across existing securities, commodities, banking, anti-money laundering, and state-level regimes. 

While federal lawmakers continue working on bespoke crypto legislation, U.S. safeguards still depend on which legacy financial laws apply, which state you live in, and how court decisions shake out.

How Does Regulation of Crypto Providers Differ?

Opening a crypto business in the EU is not a free-for-all. Any platform offering regulated crypto-asset services to retail users generally needs a formal authorization under MiCA(as a licensed Crypto-Asset Service Provider, or CASP) or another permitted regulatory status under existing financial laws, such as being an authorized credit institution or investment firm.

To keep everything transparent, everyday users can verify legitimate platforms directly on the public ESMA register. Maintained by the European Securities and Markets Authority, this registry lists authorized CASPs alongside the exact services they are legally permitted to provide, their home country, and an active blacklist of non-compliant entities.

Even so, once authorized, EU CASPs cannot simply run their business as they please. They are bound by strict, harmonised rules across three core areas:

1. Conduct requirements: They must act honestly, fairly, and professionally, keeping marketing materials clear and non-misleading while making pricing, fee schedules, and execution policies plain to see.
2. Organisational requirements: Platforms must enforce strong conflict-of-interest policies, maintain robust internal governance, establish structured complaints-handling procedures, and hold dedicated prudential capital buffers.
3. Service-specific requirements: Tailored rules apply depending on what the firm actually does—whether operating a trading exchange, executing orders on behalf of clients, providing custody, or offering portfolio advice.

In contrast, the U.S. has no single regulator or unified public register for all crypto providers. Depending on the services they offer, platforms may need to obtain state money transmitter licences, secure state trust charters, or register with federal agencies such as the SEC, CFTC, or FinCEN. As a result, the operational and conduct requirements they must meet can differ considerably depending on their activities and regulatory status.

What Information Should Users Receive Before Buying or Using a Service?

Once you have made the decision to get into crypto, before you tap "buy" or transfer funds onto an exchange? 

You should understand what you are buying, who is handling your transaction, and what risks are involved.

Exactly for this reason, disclosure rules exist to ensure buyers are not making blind bets based on promotional hype or opaque fine print. 

However, the obligations on platforms and issuers differ markedly across jurisdictions, so rules that apply  in one jurisdiction does not automatically apply to another.

The EU: Standardized, Mandatory Transparency

Under MiCA, transparency is not optional, The EU sets a clear baseline of upfront disclosure requirements that CASPs and token offerors must meet before serving retail customers:

• Fair, clear, and non-misleading information: All communications including marketing pitches and platform copy must be honest, balanced, and free from misleading claims or promises of guaranteed returns.
• Transparent pricing and fee policies: CASPs are legally required to make their fee schedules, pricing methodologies, and order execution policies easily accessible so users know the real cost of a trade upfront.
• Mandatory risk warnings: Platforms and issuers must prominently display warnings stating that crypto-assets can lose value rapidly, are volatile, and typically fall outside traditional deposit guarantee or investor compensation safety nets.
• Standardized white papers: When a token is offered to the public or listed on an EU exchange, issuers or platforms must publish an official, regulated crypto-asset white paper. Functioning much like a streamlined prospectus, it must detail the issuer's identity, the underlying blockchain technology, rights and obligations attached to the token, environmental impact, and specific project risks.

The U.S.: Disclosure Follows Asset Classification

In the United States, the disclosure you receive depends on a key legal distinction: how the asset and the transaction are classified.

• When securities laws apply: If a token offering or yield program is seen as  an "investment contract" or security under federal law, disclosure requirements enforced by the SEC can be exhaustive. Issuers must provide detailed registration statements or formal offering circulars covering audited financial histories, management compensation, governance risks, and material conflicts of interest.
• When commodities or spot markets apply: If a crypto-asset is treated as a commodity (such as Bitcoin) trading on a spot exchange, it does not trigger securities registration. Spot crypto exchanges operate primarily under state-level consumer protection and money transmitter regimes, where mandatory disclosure centers on execution terms, fee schedules, and basic commercial risks rather than standardized technical token prospectuses.

In summary, consider the table below.

How Do Rules for Holding Customer Crypto Differ?

Under the EU’s MiCA framework, Crypto-Asset Service Providers (CASPs) offering custody have to play by strict, non-negotiable rules:

• Clear custody agreements: Platforms must establish a formal, transparent agreement with each client outlining rights, duties, and how assets are handled.
• Segregation of client assets: Customer funds must be kept strictly separated from the platform’s own balance sheet, ensuring users aren't left stranded as general creditors if the company goes down.
• Accurate position records: Platforms are required to maintain real-time, matching records of what every user owns down to the exact decimal point.
• Direct custodian liability: If client crypto is lost due to a hack, operational failure, or negligence attributable to the platform, the custodian is held legally accountable to compensate for those losses.

How Do the EU and U.S. Regulate Stablecoins?

The EU moved first and already has active rules on the ground. Since 30 June 2024, MiCA’s regimes for E-Money Tokens (single-currency pegs) and Asset-Referenced Tokens (multi-asset pegs) have been fully in force. 

In the EU, you can't just launch a stablecoin and hope for the best. Issuers need an official license, must hold matching 1:1 cash reserves in safe accounts, and have to let users cash out at face value anytime. All while continuous regulatory supervision.

Across the Atlantic, the U.S. passed the GENIUS Act in July 2025 to create federal rules for payment stablecoins. But there’s a big gap between signing a bill and having everything running: regulators are still working out the finer licensing details. 

In simple terms, Europe’s rules are already part of daily life, while the U.S. is still tuning the engine.

How Are Market Manipulation and Misconduct Addressed?

As with everything else, there are consequences for market manipulation and misconduct : This runs from preventing insiders from front-running retail traders and stopping bad actors from faking volume or moving prices artificially.

Just like with stablecoins, the EU and the U.S. tackle this challenge through two very different setups.

In the EU, MiCA lays down clear ground rules so markets stay fair. It bans the classic shady tricks: 

• No insider trading (using secret info to make a profit), 
• No leaking confidential project updates early, 
• No market games like wash trading (trading with yourself to fake activity) or spreading fake rumors to move prices.

The U.S. handles this differently. Instead of one unified crypto rulebook, regulators use existing fraud rules meant for traditional stocks and commodities. 

Whether the SEC or the CFTC takes action usually depends on what kind of asset the token actually is. Both agencies teamed up in March 2026 to offer clearer guidance on where those lines sit, but the full market rules are still being worked out.

What Happens When a Platform Has a Technology Failure?

Under DORA, the E.U regulates technology outages. Authorized Crypto-Asset Service Providers (CASPs) must follow the same operational resilience standards as traditional banks. 

A platform cannot simply treat a crash as bad luck; it must operate a legally binding framework covering:

• ICT risk management: Identifying system vulnerabilities and maintaining strict defenses.
• Incident management: Logging disruptions and reporting major outages to regulators on strict deadlines.
• Testing and recovery: Regularly stress-testing systems and maintaining tested backups to restore operations quickly.
• Third-party technology risk: Monitoring and holding outside vendors (like cloud hosts) to high operational standards.

Are Crypto Assets Protected by Deposit Insurance or Compensation Schemes?

Holding crypto on a regulated app doesn’t mean it works like money in a bank account.

A lot of people assume that if a platform has a license, government deposit insurance automatically protects them if things go south. It doesn’t. 

In both the US and Europe, traditional safety nets like FDIC insurance or EU bank guarantee schemes are built for regular cash in a bank, not crypto. 

In the EU, having a MiCA license means the platform follows strict rules, but it does not give your tokens government-backed deposit protection.

If you use a traditional bank or broker that happens to offer crypto, always read the fine print,  that safety net usually only covers the actual cash sitting in your account, not the crypto tokens you buy with it.

Practical Example: The Same Crypto Purchase in the EU and the U.S.

To see how these two systems feel in practice, imagine an investor named Alex buying and holding the exact same cryptocurrency (let us say Bitcoin) through a regulated platform in Europe, and doing the identical trade in the United States.

The checkout screen might look similar, but the legal checklist behind it is completely different.

The Workflow for Alex in E.U

Under the EU’s Markets in Crypto-Assets (MiCA) framework, Alex follows one unified checklist across all 27 member states:

1. Verify the platform on the official register: Alex searches the central ESMA public register to confirm the platform is an authorized Crypto-Asset Service Provider (CASP) with valid permissions to hold custody and execute trades.
2. Review the mandatory token white paper: Before buying, Alex can access a legally required, standardized white paper that details the token’s underlying tech, project risks, and environmental footprint.
3. Inspect clear fees and risk disclosures: The platform is required to display all trading, deposit, and withdrawal fees upfront alongside clear risk warnings before Alex confirms the trade.
4. Rely on statutory custody segregation: Alex’s tokens are separated from the exchange’s balance sheet by law, and the platform bears direct legal liability if assets are lost due to a platform hack or operational failure.
5. Use a free, formal complaint path: If an execution fails or assets go missing, the platform must provide a structured, zero-cost dispute resolution process subject to review by national regulators.

The Workflow for Alex in the U.S.

Here is no single central register or uniform crypto code. Alex must navigate several overlapping layers to understand the terms of the trade:

1. Classify the asset and transaction: Alex must determine how the asset is categorized (for instance, as a digital commodity under CFTC purview or an investment contract/security under SEC oversight, guided by their joint framework).
2. Identify the exact operating entity: Major U.S. platforms operate through several corporate entities. Alex must check the user agreement to verify which specific affiliate such as a trust company or money services business is executing the order and holding the tokens.
3. Check state and federal licensing: Because there is no single federal CASP license, Alex must verify whether the platform is authorized in their home state, such as holding a New York BitLicense or individual state money transmitter licenses.
4. Scrutinize the provider’s private custody terms: With no single federal custody statute covering all platforms, Alex must check the platform’s private user agreement to see if client assets are segregated, how bankruptcy risk is handled, and what private insurance (if any) exists.
5. Handle disputes through private arbitration: If something goes wrong, recourse is typically governed by standard customer support channels and the platform's mandatory binding arbitration terms, rather than a statutory regulatory dispute portal.

Does Stronger Regulation Mean Lower Investment Risk?

The simple answer is No! Stronger regulation sets rules for market conduct, but it cannot eliminate market risk.

Both the EU and U.S. frameworks enforce provider licensing, mandatory disclosures, custody standards, and market-abuse rules. However, none of these controls prevent crypto prices from crashing, nor do they guarantee that an issuer or platform will never fail.

It is vital to separate regulatory protection from investment protection:

• Regulatory protection ensures the entity holding your money behaves honestly, maintains segregated accounts, and discloses known risks.
• Investment protection implies your capital is safe from losses which no framework provides.

Ultimately, regulators in both jurisdictions can govern who provides a crypto service and how that service is delivered, but neither system guarantees the value, stability, or financial performance of the asset itself.

Disclaimer: The content provided in this article is for educational and informational purposes only and should not be considered financial or investment advice. Interacting with blockchain, crypto assets, and Web3 applications involves risks, including the potential loss of funds. Venga encourages readers to conduct thorough research and understand the risks before engaging with any crypto assets or blockchain technologies. For more details, please refer to our terms of service.

Withdraw crypto from an EU exchange today and the form will often ask who owns the destination wallet. That extra step comes from the crypto Travel Rule.

Under the rule, your platform needs details on two people. One is whoever sends the transfer, known as the originator. The other is whoever receives it, the beneficiary. It keeps those details on record and, where another provider sits at the receiving end, passes them on.

The EU's Travel Rule requirements sit in Regulation (EU) 2023/1113. It was published in June 2023, but nothing changed for users until 30 December 2024, when it started to apply. The Markets in Crypto-Assets Regulation (MiCA) started applying to crypto firms that same day.

Banks got there first. The Financial Action Task Force (FATF), a Paris-based anti-money laundering body, applied it to wire transfers back in 2001. In June 2019 it stretched the idea to cover crypto. FATF guidance isn't law, though. Each country writes its own version, and the EU's is stricter in places.

When Does the Crypto Travel Rule Apply in the EU?

For the rule to apply, a regulated firm has to be handling the transfer somewhere along the way. Which coin you send, or which blockchain it runs on, makes no difference.

The trigger is a CASP (crypto-asset service provider), the type of firm authorised under MiCA, the EU's wider crypto rulebook. If an app in the EU holds your coins for you, it’s almost certainly one.

Article 2 sets the geography. If any provider touching the transfer, including a go-between, has its registered office in the EU, the transfer is caught. Transfers between two platforms are covered. So are transfers between a platform and a self-hosted address, meaning a wallet whose keys you hold yourself.

There's one big exception. A person-to-person transfer from one self-hosted wallet to another, with no provider involved, falls outside this Regulation. Not every blockchain transaction triggers the EU Travel Rule.

Travel Rule scenarios at a glance

"EU CASP" means a provider with its registered office in the EU.

What Information Accompanies a Crypto Transfer?

Article 14 sets out two Travel Rule lists, one for the originator and one for the beneficiary.

Sender's details

• Name
• Distributed-ledger address (the wallet address) and crypto-asset account number, where one is used
• Either their address with country, official ID document number and customer number, or their date and place of birth

Recipient's details

• Name
• Distributed-ledger address and crypto-asset account number, where one is used

Your own details are already on file from when you opened the account, so the recipient's name is usually the part you end up typing in.

What Happens When You Send Crypto From One Platform to Another?

The most common case is a move between two EU exchanges.

The sending exchange sends the Travel Rule information first, or alongside the coins. It can't follow on later. Many providers exchange it in a shared data format called IVMS101, over messaging systems built for the job.

It works a bit like a parcel whose delivery note goes by a separate courier. The coins travel on the blockchain. The Travel Rule data travels between the two firms.

The receiving exchange then checks that the Travel Rule information has arrived and is complete. If a field is missing, it applies its own procedures before crediting the funds (see the section on delays).

What Changes When You Transfer to or From a Self-Hosted Wallet?

Self-custody isn't prohibited. Keep your coins on a hardware wallet for ten years if you like; the Travel Rule has nothing to say about it. Venga's guide to custodial and non-custodial wallets covers that choice in more detail.

What changes is the platform's side of the paperwork. Under Article 14(5), a CASP sending to a self-hosted address must obtain and hold the Travel Rule information, and make sure the transfer can be individually identified. Article 16(2) applies the same duty to incoming transfers.

There's no second provider to receive the data, so the platform keeps it on file itself. On many withdrawal forms, it shows up as a yes/no question about whether the wallet is yours. If it belongs to someone else, the form will want their name as well.

What Does the €1,000 Threshold Mean for Self-Hosted Wallets?

€1,000 is one of the most misread numbers in this area. It isn't a general EU threshold below which the crypto Travel Rule switches off.

Worth knowing: FATF's version allows a lighter touch for small transfers, with less information needed below USD/EUR 1,000, and that's likely where the myth started. The EU didn't copy that for transfers between providers. A €20 transfer between two EU exchanges carries the same data as a €20,000 one.

The €1,000 figure only applies when one side of the transfer is a self-hosted address. Above that amount, the platform must take adequate measures to assess whether the address is owned or controlled by its customer.

Platforms run the check in different ways. With a signed message, your wallet produces a digital signature the platform can verify, and no coins move at all. A test transfer works differently. You send a tiny amount the platform picks from that address. Ticking a box that says "this is my wallet" is generally not enough by itself.

Below €1,000, the platform still collects and keeps the Travel Rule details. It just isn’t legally required to run the ownership check.

Is Your Personal Information Written on the Blockchain?

No. Article 14(4) is clear. Travel Rule information can travel separately from the transfer of crypto-assets, rather than being attached to it or written into it.

On-chain, nothing new appears. Anyone looking up the transaction sees two addresses, an amount and a timestamp, the same as before 2024. Names, ID numbers and dates of birth stay off-chain.

Why this matters: That data is personal, so GDPR (the General Data Protection Regulation) applies to every EU firm that handles Travel Rule data. It's the same law that already covers the ID you uploaded when you opened your account.

Why Can a Transfer Be Delayed or Require More Information?

Receiving platforms, and intermediary platforms that pass a transfer along, must have procedures for detecting missing or incomplete Travel Rule information.

When something is missing, Article 17 lets the receiving provider decide, on a risk basis, how to respond. Often it pauses the transfer and asks for whatever’s missing, and the funds stay put until the details arrive. Otherwise, it can refuse it or send the crypto-assets back.

The European Banking Authority (EBA) has published guidance on how providers make that call. The EBA's Travel Rule guidelines started applying on the same day as the Regulation.

For users, a Travel Rule hold usually means a field was empty or didn’t match.

What If the Other Crypto Provider Is Outside the EU?

An EU platform keeps its obligations when the provider on the other side is established outside the Union. It still has to identify that counterparty and send the Travel Rule information, even where the other country has applied the FATF standard differently.

Differences like that are common, and FATF checks on them every year. Its July 2026 review of how countries apply the standard found progress on adoption, but almost half of the countries with Travel Rule laws hadn’t taken any supervisory or enforcement action.

Send to a platform in one of those countries and you might face an extra question, or wait a little longer for the funds to land. One technical point. An address at a non-EU exchange doesn't count as self-hosted under Article 3(20), so the €1,000 ownership check doesn't apply to it.

Practical Example: Exchange → Own Wallet → Another Exchange

Lucía lives in Madrid. She holds €1,500 of ETH (Ether) and moves it three times in a year.

Stage 1: EU Exchange to Another EU Exchange

Lucía moves the ETH from Exchange A to an account in her name at Exchange B, both regulated in the EU. Her Travel Rule details go across as originator and as beneficiary. Exchange B checks they're complete and credits her account.

Stage 2: EU Exchange to Her Own Wallet

She then withdraws the ETH from Exchange B to her own hardware wallet. Exchange B records the Travel Rule information for the withdrawal. As €1,500 is over the threshold, it also asks her to prove she controls the address, and she signs a message from the device.

Stage 3: Own Wallet to Another EU Exchange

Six months later she sends the ETH to Exchange C, also in the EU. Exchange C collects the Travel Rule details from Lucía as its customer. The deposit comes from a self-hosted address and exceeds €1,000, so Exchange C also assesses whether she owns or controls that wallet.

What Does the Crypto Travel Rule Not Mean for Users?

Three common assumptions don't hold up:

• It doesn't ban self-hosted wallets.
• It doesn't put names or ID numbers on the blockchain.
• It doesn't set a €1,000 maximum for crypto transfers.

A complete set of Travel Rule information won't guarantee a transfer is approved, either. Transfers still go through sanctions screening, plus the platform's own anti-money laundering (AML) checks. A transfer can be stopped there even with every field filled in.

The practical point is this. The Travel Rule is attached to regulated service providers. When one is involved, the information moves with your crypto. When a transfer runs between two people's own wallets, this rule doesn't reach it.

Disclaimer: The content provided in this article is for educational and informational purposes only and should not be considered financial or investment advice. Interacting with blockchain, crypto assets, and Web3 applications involves risks, including the potential loss of funds. Venga encourages readers to conduct thorough research and understand the risks before engaging with any crypto assets or blockchain technologies. For more details, please refer to our terms of service.

Once every 210,000 blocks, Bitcoin starts paying its miners half as much new BTC as before. That's the Bitcoin halving. Maybe you typed “what is halving in crypto” into Google and ended up here. It's a slightly odd name, honestly. The only thing that gets cut in half is a payment.

The most recent one fell on a Saturday, 20 April 2024, at block 840,000. Up to that block, finding one earned a miner 6.25 BTC. From then on it earned 3.125.

The effect on supply can be worked out with a calculator. The effect on price is much harder to pin down, and most of the talk around each halving sits somewhere in that gap.

What Exactly Happens During a Bitcoin Halving?

Every block starts the same way, with the miner who found it paying themselves. Bitcoin people call it the coinbase transaction (yes, the name is confusing). Part of that payment is brand-new BTC, known as the block subsidy. The rest is whatever fees users attached to their transactions.

The halving only goes after the subsidy. Bitcoin splits its history into 210,000-block stretches. With every new stretch, the payout that started at 50 BTC gets cut in half once more. Block 839,999 was still in the fourth stretch, so it paid 6.25 BTC. One block later the fifth had begun, and the payout dropped to 3.125 BTC.

Nobody has to sign anything off. A miner who tries to pay themselves the old amount gets their block thrown out by everyone else on the network, and the electricity they burned finding it goes to waste.

How Much Does a Halving Reduce New Bitcoin Issuance?

A new block turns up every 10 minutes or so, on average. That's about 144 a day, and the whole calculation hangs on it. Here's what the 2024 halving event did to daily issuance:

• Before: 6.25 BTC a block, so about 900 new BTC a day
• After: 3.125 BTC a block, so about 450 new BTC a day

Multiply by 365 and you go from about 328,500 new coins a year to about 164,250. That's 164,250 fewer coins a year, give or take.

Treat those as ballpark figures. Some days the network churns out 150 blocks. Other days it only manages the 130s, and the real total wobbles around 450 as a result.

Why Doesn't Halving Cut Bitcoin's Existing Supply in Half?

Some newcomers assume a halving removes half of the bitcoin already in existence. Your coins don't go anywhere. If you had 0.5 BTC in a wallet on 19 April 2024, you still had 0.5 BTC on the 21st.

It helps to think in terms of stock and flow. The stock is everything mined so far, and the flow is what gets added over a set period, such as a day or a year. A halving changes the flow only. Our tokenomics guide covers a related distinction, the one between circulating supply and max supply.

Bitcoin's stock is already large next to its flow. The 20 millionth coin came out of block 939,999 in March 2026. Fewer than a million are left to mine, and it'll take until roughly 2140 to dig them all out.

Worth knowing: Do the sums and the shrinking effect shows up fast. Before April 2024, around 328,500 new coins a year were landing on a pile of about 19.7 million. Call it 1.7%. Today it's about 164,250 on roughly 20.1 million, nearer 0.8%. Once 2028 rolls round it's roughly 82,000, which is about 0.4%. Each halving still chops the flow in two. It just moves the overall supply by less every time.

What Does Halving Change for Miners?

Most mining costs are paid in euros or dollars, for electricity, hardware and buildings, and none of them change on halving day. Only the subsidy does.

Let's invent a mine. It makes 10 BTC a month from the subsidy and spends €300,000 a month on power. We'll put bitcoin at €60,000, purely for the maths, which means the subsidy was bringing in €600,000 before the halving. After it, the mine gets 5 coins, worth €300,000 if the price hasn't budged. The power bill now swallows the whole subsidy, and fees have to cover hardware, staff and everything else.

Operators with older, less efficient machines usually feel this first, and some switch them off. Bitcoin does have a release valve here. Every 2,016 blocks, about once a fortnight, the network looks at how fast blocks have been coming and makes mining easier or harder. If enough machines go dark, the ones left running get an easier puzzle. That's roughly what happened after April 2024. Hashrate sagged for a few weeks, then kept climbing and set fresh records in 2025.

Fees can be erratic. Halving day in 2024 had an odd twist. Block 840,000 coincided with the launch of Runes, a new way to create tokens on Bitcoin, and people paid about $2.4 million in fees to get in early. The subsidy in that same block was worth roughly $200,000. The frenzy didn't last. In August 2026, Glassnode put fees at a measly 0.69% of what miners earned.

Satoshi Nakamoto's original whitepaper expected fees to take over eventually, noting that once enough coins exist, "the incentive can transition entirely to transaction fees". Whether fees alone can pay for the level of security Bitcoin has today is still debated, and the last fractions of subsidy aren't expected until around 2140.

Why Does a Predictable Event Create Such a Strong Market Narrative?

Everything about the halving can be calculated in advance, down to the block number, which in theory gives markets years to price it in. Online countdown trackers already shows an estimated date and time for the next halving in April 2028.

Even so, each halving event brings a familiar run of headlines about a coming "supply shock". The story is easy to repeat: fewer new bitcoin each day, while nobody can say how much demand there will be.

Models have made that story more persuasive. Back in March 2019, a pseudonymous analyst called PlanB put out the stock-to-flow model. It tied Bitcoin's price to its shrinking issuance, and plenty of fans took it as a sign of $100,000 or more by the end of 2021. Bitcoin topped out near $69,000 that November. Stories like that are why we think separating a product from the story around it pays off.

Does Lower New Supply Mean Bitcoin's Price Must Rise?

Not necessarily. Fewer new coins can help the price, but only if buyers stick around, and the halving has no say over that.

Look at what happened after April 2024. Miners kept adding about 450 BTC a day the whole time. Bitcoin's record came on 6 October 2025, at around $126,000. Four months later it had slid to somewhere between $60,000 and $70,000. Same issuance, very different prices.

Swings like that come from the demand side. Rates matter. So does the amount of spare cash in the system, plus ETF money coming and going, new rules, leverage and plain old mood. In January 2022, IMF research found Bitcoin moving more in step with US stocks since the pandemic. Its correlation with the S&P 500 was just 0.01 in 2017–19. By 2020–21 it had jumped to 0.36.

Worth knowing: Miners make roughly 450 BTC a day. On a normal day, exchanges swap tens of thousands. So when the price jumps or drops on a Tuesday afternoon, it's the trading doing it, not the new coins.

What Can Previous Halvings Actually Tell Us?

Bitcoin has gone through four halvings so far, each one cutting the subsidy in half again.

Bitcoin halving schedule

(We've used 144 blocks a day here. Real days vary.)

The market looked different each time. When the first halving hit in November 2012, you could pick up a whole bitcoin for about $12, and most people bought theirs on Mt Gox. The 2020 one arrived just two months after the March crash, with the US Federal Reserve having already slashed rates to near zero. And by April 2024, US spot Bitcoin ETFs had been trading for three months.

Prices did rise in the year or so after each previous halving, and that's the basis of the "halving cycle" idea. Four events, each under its own set of conditions, is a small sample, though, and it can't show whether the halving caused those rises or whether the pattern will hold. Our guide to trying to time a Bitcoin purchase around cycles goes into why that kind of timing tends to be unreliable.

When Is the Next Bitcoin Halving?

Next up is block 1,050,000. That's when the subsidy drops from 3.125 BTC to 1.5625 BTC, and new supply falls to something like 225 BTC a day.

If blocks keep coming at their recent pace, you're looking at April 2028. There's no point circling a date yet, though. In October 2026 the forecasts were already spread between 7 and 17 April, and they'll keep moving until the block turns up.

Worth knowing: Blocks, not dates, set the timing. If a wave of new machines switches on before the next difficulty reset, blocks speed up a little and the halving date edges earlier. When miners pull the plug, it slips back.

What Really Matters About the Bitcoin Halving?

The supply side is the easy bit. Anyone can check the numbers for themselves: around 900 new BTC a day before April 2024, about 450 now, and roughly 225 once 2028 comes round.

What the market makes of that is far messier. Demand, macro conditions and sentiment move independently of block height, and in the two years after the last halving they pushed the price to a record before taking roughly half of it away again.

The Bitcoin halving reliably changes Bitcoin's new supply, then, but it doesn't reliably tell anyone what the price will do next.

Disclaimer: The content provided in this article is for educational and informational purposes only and should not be considered financial or investment advice. Interacting with blockchain, crypto assets, and Web3 applications involves risks, including the potential loss of funds. Venga encourages readers to conduct thorough research and understand the risks before engaging with any crypto assets or blockchain technologies. For more details, please refer to our terms of service.

Listing a crypto-asset on an EU trading platform is not simply a matter of technical integration, liquidity or commercial demand. The token first needs an appropriate legal classification, and MiCA imposes conditions on both admission to trading and the platform that accepts the asset. It's sort of like before you get a driver's license, you first have to pass a test. Before you list your token, you first have to satisfy legal conditions.

What Has to Be Determined Before a Token Can Be Listed?

The first question is what the token legally represents, not what its issuer calls it. Its rights, economic features, value reference and structure can determine whether it is an ordinary MiCA crypto-asset, an Asset-referenced token (ART), an E-money token (EMT), a financial instrument or potentially outside MiCA's scope. Here's a table describing each of the classifications and what has to be determined before listing:

Why Does a Token's Legal Classification Change the Listing Rules?

A token’s legal classification completely changes its listing rules because the European Union regulates different types of digital assets under entirely separate frameworks.

If a crypto token is legally classified as a financial instrument (like a digital stock or bond), the EU's main crypto regulation, MiCA, does not apply to it at all. Instead, that token must follow traditional, highly strict financial laws like MiFID II.

Even within MiCA itself, tokens are separated into different categories with their own distinct rules:

• Asset-Referenced Tokens (ARTs): Tokens pegged to multiple currencies or commodities have their own dedicated, strict regime.
• Electronic Money Tokens (EMTs): Tokens pegged to a single official currency face separate rules similar to traditional electronic money.
• Other Crypto-Assets: General utility tokens or cryptocurrencies follow the standard, baseline MiCA rules.

Essentially, regulators do not treat all tokens the same. The legal category decides which rulebook a crypto exchange must follow before listing the asset.

What Is Required Before an Ordinary MiCA Token Can Be Admitted to Trading?

Before an ordinary crypto-asset (other than an asset-referenced token or e-money token) can be admitted to trading in the European Union, a project must meet four main requirements under the Markets in Crypto-Assets Regulation (MiCA): 

• A legal person or entity: The issuer (or the trading platform via a written agreement) must be a recognized legal entity rather than an anonymous or unorganized group. 
• A MiCA-compliant white paper: The team must draw up a detailed crypto-asset white paper containing required disclosures, project info, and risk factors. 
• Notification and publication: The white paper must be sent to the National Competent Authority at least 20 working days before it is published, and then formally published before trading starts (no prior regulatory approval is required, just notification). 
• Compliant marketing communications: Any promotional materials tied to the public offer or listing must be clearly identifiable as marketing, fair, and consistent with the white paper.

Why Do ARTs and EMTs Follow a Different Route?

Stable-value tokens cannot simply use the general Title II listing process. An ART generally needs an appropriately authorised EU issuer or eligible credit institution, while an EMT offered or admitted to trading generally needs an issuer authorised as a credit institution or electronic money institution, subject to the specific MiCA exceptions.

What Must the Trading Platform Assess Before Listing a Token?

A MiCA trading-platform operator must have transparent admission rules and assess whether the crypto-asset is suitable for trading. This includes factors such as the reliability of its technical solution and potential links to illicit or fraudulent activity, alongside the issuer's and development team's experience, track record, and reputation.

Can Privacy Features Prevent a Token From Being Listed?

Yes, privacy features can absolutely prevent a token from being listed.

Under the EU’s Markets in Crypto-Assets (MiCA) regulation, crypto exchanges are strictly forbidden from listing tokens with inbuilt anonymisation functions.

The only exception is if the exchange can fully identify the token holders and trace their entire transaction history. Because true privacy coins (like Monero) inherently mask this information, exchanges are forced to delist or ban them to remain compliant.

Why Can a Token Be Restricted or Delisted After It Is Listed?

Admission to a trading platform is not permanent. Just because a token gets listed does not mean it stays there forever.

Platforms set strict ongoing conditions, and a token will be restricted or delisted if it fails to meet them. Trading is typically suspended or removed due to:

• Low liquidity: Dropping trade volumes that risk price manipulation.
• Poor disclosure: Failing to share project updates or financial data.
• Security or legal risks: Code exploits, fraud, or regulatory violations.

Practical Example: One Token, Three Possible Legal Routes

Token X is fictional. The same token lands on a different listing path depending on its economic features.

Scenario A: access to a digital service (MiCA Title II)

• The person seeking admission to trading drafts a white paper, notifies it to the competent authority, and publishes it. The authority does not approve it.
• Offer exemptions do not apply if communications mention seeking admission to trading.
• The platform must be an authorised crypto-asset service provider and should check the white paper before listing.
• Listing impact: Relatively light. The work is the white paper, the notification, and the platform’s admission checks.

Scenario B: value held against EUR (potentially an EMT)

• Only the issuer can seek admission to trading, and it must be a credit institution or an e-money institution with a notified, published white paper.
• Third parties can seek admission only with the issuer’s written consent.
• EMTs are deemed electronic money, so redemption rights apply.
• Listing impact: The issuer must now be a regulated institution. A tracked basket of currencies or assets would point to an ART instead.

Scenario C: rights like a share or bond (potential financial instrument)

• ESMA’s guidelines look at the actual rights, not the label or the technology. A transferable security needs no payment function, must be a class of securities, and must be negotiable on the capital market.
• Financial instruments fall outside MiCA and under MiFID II.
• Listing impact: The MiCA white paper route no longer applies. The token would likely need a MiFID II trading venue and prospectus rules (from my general knowledge). National law also matters, because some countries do not allow tokenised securities.

Does Listing Mean a Token Has Been Approved by a Regulator?

No, listing or trading a crypto-asset does not mean it has been approved by a regulator.

No Prior Approval: Article 8 of MiCA explicitly states that regulators shall not require prior approval of white papers or associated marketing communications for ordinary tokens.

Listing friction exists because a token is a technical asset, a set of economic rights, and a potential regulated product all at once. The legal treatment of those rights determines which path to trading is an option.

Disclaimer: The content provided in this article is for educational and informational purposes only and should not be considered financial or investment advice. Interacting with blockchain, crypto assets, and Web3 applications involves risks, including the potential loss of funds. Venga encourages readers to conduct thorough research and understand the risks before engaging with any crypto assets or blockchain technologies. For more details, please refer to our terms of service.

A regulated crypto platform must do much more than protect users’ login details. 

The base line should have several layers of security in place, including limiting employee access to sensitive information, securely encrypting data and private keys, continuously monitoring its systems for threats, regularly checking for vulnerabilities, carefully managing system updates, preparing for security incidents, and ensuring that third-party technology providers meet strict security standards.

Well, what about 2FA? Two-factor authentication (2FA) and strong passwords only secure the front door. The true gate-keeping work happens behind the scenes, ensuring the platform's internal plumbing can withstand attacks, operational failures, and vendor breaches without putting user funds or personal data at risk.

What Does “Minimum Security” Actually Mean?

Unlike the word, Minimum Security means more than simply protecting users’ accounts, it is a legally binding baseline established by European financial regulation.

For crypto-asset service providers (CASPs), security requirements operate under a dual framework:

• MiCA (Markets in Crypto-Assets): During the authorisation phase, MiCA requires platforms to document and demonstrate the reliability of their Information and Communication Technology (ICT) systems, governance structures, and security arrangements before handling customer assets.
• DORA (Digital Operational Resilience Act): Once authorised, CASPs fall under DORA’s comprehensive digital operational resilience regime. DORA shifts the focus from basic preventive security to operational survival: ensuring a platform can withstand, absorb, and quickly recover from severe cyber threats, hardware failures, or network disruptions.

It is worth taking into account that the regulatory technical standards (RTS) under DORA outline specific, non-negotiable requirements across areas like user access management, cryptographic key protection, audit logging, network segregation, and day-to-day ICT operations.

Here is how those baseline controls break down in practice, what they protect against, and where they actually meet with the user:

Why Is Account Security Only One Layer of Protection?

Putting a bank-vault-grade biometric lock on your front door is fantastic until you realize the back windows don't have latches.

While strong customer authentication (SCA) dramatically reduces the risk of account takeovers, it only protects the front door. True platform security relies on what is happening behind the scenes: internal staff access, infrastructure, APIs, databases, and administrative accounts.

If a platform misconfigures an API endpoint or leaves an internal server exposed, the strongest password in the world won’t save the day. A secure platform defends the entire perimeter.

How Should Access and Privileged Accounts Be Controlled?

Nobody at a crypto platform needs the keys to every single room.

Regulated platforms must stick to the principle of least privilege: both physical and digital access are strictly limited to legitimate, approved job functions. 

The support specialist troubleshooting your ticket has zero business peeking into private database clusters or treasury infrastructure.

A tight access policy comes down to three non-negotiables:

• Strict assignment: Every single access right must be formally requested, justified, and logged.
• Routine cleanup: Permissions should be audited regularly and revoked the minute an employee switches roles or leaves the company.
• Red-carpet security for admin accounts: Anyone touching core databases or critical systems needs extra friction, think hardware security keys, short session timeouts, and multi-person approvals so no single person can unilaterally move needles (or funds).

How Should Data and Cryptographic Keys Be Protected?

A regulated crypto platform should treat encryption as an ongoing security process, not just a marketing promise. 

Under DORA technical standards, crypto platforms can't just flip an encryption switch and call it a day. Data protection must cover two distinct fronts:

• Data in transit and at rest: Every scrap of sensitive info, from your passport scan to your euro deposits must be strongly encrypted while traveling across networks and while sitting inside databases. 

If an intruder manages to intercept traffic or steal a hard drive, they should end up with nothing more useful than unreadable digital confetti.

• Full lifecycle key management: Cryptographic keys (the master tools that sign transactions and decrypt sensitive records) are the crown jewels. A compliant platform must actively manage them from cradle to grave: generating them in secure hardware (like HSMs), strictly limiting access, rotating them on a disciplined schedule, and destroying retired keys cleanly.

Because at the end of the day, top-tier encryption algorithms are practically unbreakable. It’s almost always sloppy key storage that lets the cat out of the bag.

How Should a Platform Detect Vulnerabilities and Suspicious Activity?

A security setup that only blocks recognized threats is always one step behind. Rather than simply deflecting attacks that are already well-known, a platform needs controls built to actively sniff out problems, hidden weaknesses, and unusual behavior across its entire infrastructure.

Effective detection brings together several continuous layers working at the same time:

• Detailed system logging and real-time monitoring of all network activity
• Automated anomaly detection that flags unusual spikes or suspicious access patterns instantly
• Routine vulnerability assessments and penetration tests to catch software flaws early
• Active cyber threat awareness to spot emerging attack methods before they reach the platform

Why Are Updates and System Changes a Security Issue?

Fixing a vulnerability shouldn't accidentally create a fresh one. While patches and configuration updates remove security holes, rushing them out can crash systems or open new blind spots. 

Because of this risk, DORA requires platforms to follow a strict change-management pipeline. Every single modification must be formally logged, evaluated, and thoroughly tested before getting final sign-off. 

Only then is it deployed, verified on the live system, and backed by a quick rollback plan just in case.

What Should Happen When a Security or ICT Incident Occurs?

When something goes wrong, a platform shouldn't be guessing what to do next. It needs a clear game plan ready to go: spot the issue fast, track what happened, stop the damage, and get the right team on it immediately.

Getting the app back online is only the first step. The team also needs to find the root cause and fix it for good because simply restarting a broken system just leaves the door open for it to happen again.

Why Are Backups and Recovery Part of the Security Baseline?

Even the best defenses can be tested by hardware crashes, power cuts, or severe outages, which is why recovery is just as vital as prevention.

A platform needs tested backup plans ready at all times. If something catastrophic knocks the core servers out, the team should be able to restore transaction records, account balances, and system settings quickly, keeping downtime short and making sure user data remains intact.

What If the Platform Uses Cloud or Other External Providers?

Modern crypto platforms rarely build every server or tool from scratch. They routinely rely on external providers for cloud hosting, data processing, customer communications, and specialized cybersecurity tools.

Under DORA, using outside help doesn't mean passing the buck. The core rule is crystal clear: outsourcing technology does not outsource regulatory responsibility.

If a cloud provider goes down or leaks data, the platform cannot simply point fingers and shrug. That is why it must actively manage these third-party risks:

• Assessing critical dependencies: Knowing exactly which outside tools the platform cannot survive without, and avoiding dangerous single points of failure.
• Contractual safeguards: Demanding clear, legally binding standards for data security, uptime guarantees, and audit rights.
• Continuity and exit plans: Having a concrete fallback strategy if a key vendor suddenly changes terms, suffers an outage, or shuts down.

Practical Example: Suspicious Access to a Critical System

To see how these controls work together, imagine an alert goes off at 2:00 AM on a platform’s withdrawal server. Here is how layered security handles it in real time:

1. Access limits block the damage: An admin credential is used off-hours, but strict permission limits prevent it from touching funds or overriding multi-signature approvals.
2. Monitoring sounds the alarm: Automated surveillance flags the unusual login time and location, alerting the on-call security team instantly.
3. Logs trace the footprint: Immutable audit trails show engineers every command attempted, confirming zero funds left the platform.
4. Incident response locks it down: The team freezes the compromised account, cuts active sessions, and isolates the server.
5. Credentials get wiped: Keys are rotated, the machine is cleaned, and fresh patches are applied.
6. Recovery checks clear the green light: Engineers verify data integrity and account balances before quietly resuming normal withdrawals.

When every layer does its job, an attack becomes a quiet routine check rather than a crisis.

What Do Security Controls Not Guarantee?

Even the strictest regulations cannot promise a 100% hack-proof world.

Meeting strict security standards does not guarantee that a platform will never suffer an outage, lose data, or get caught up in a crash at an external cloud provider. In tech, absolute zero risk does not exist.

You also won't ever see every single lock and bolt a platform uses behind the scenes. That is by design: publishing the exact blueprint of internal infrastructure just gives bad actors a handy map to study.

Ultimately, a credible security baseline is not a marketing label, a shiny certificate, or a single impenetrable wall, it is a combination of preventive controls, continuous monitoring and tested response processes.

Disclaimer: The content provided in this article is for educational and informational purposes only and should not be considered financial or investment advice. Interacting with blockchain, crypto assets, and Web3 applications involves risks, including the potential loss of funds. Venga encourages readers to conduct thorough research and understand the risks before engaging with any crypto assets or blockchain technologies. For more details, please refer to our terms of service.

DORA stands for the Digital Operational Resilience Act and it is a European Union law that entered into application on January 17th 2025. It can be simplified as a framework that expects regulated financial and crypto businesses to keep important digital services available, maintain or restore them when disruption occurs, and continuously control the ICT risks that could interrupt them. 

DORA governs covered financial entities including credit institutions, payment service providers, investment firms, crypto-asset service providers, insurance companies, and ICT third-party service providers. If you operate in the EU financial sector, DORA likely governs your security operations. 

How Do Availability, Continuity, and ICT Risk Control Fit Together?

These three concepts are all part of the same system, just like how you, your brother, and your sister are part of the same family. Availability concerns whether systems and data can be used when needed; continuity concerns keeping critical functions running or restoring them after disruption; ICT risk control covers the processes used to identify, prevent, monitor and manage technology risks. Here is a table outlining the different concepts, their simple meaning, an example for a crypto user, and the relevant DORA response so you can see how DORA works in action according to its different articles.

What Does Availability Mean for a Crypto User?

For a crypto user, availability under DORA means the platform works exactly when you need it.

It translates directly into four core functions you notice every day:

• Logging In: You can access your wallet, exchange, or dApp instantly without encountering timeouts or server errors.
• Viewing Accurate Information: Your asset balances, portfolio values, and live price feeds are up-to-date and never glitch or show stale data.
• Submitting Transactions: You can buy, sell, deposit, or withdraw crypto immediately without the system freezing or failing under heavy traffic.
• Accessing Critical Services: You can reliably use vital platform features, such as contacting emergency support, executing smart contracts, or retrieving account histories.

What Happens When Availability Breaks?

Under the Digital Operational Resilience Act (DORA), when availability breaks, covered entities must immediately shift from prevention to business continuity, response, and recovery.

Specifically, they are required to activate arrangements designed to:

• Limit disruption to the business and its customers.
• Resume important functions in a timely manner.
• Restore systems and data safely and securely.

What Does ICT Risk Control Mean Before an Outage Happens?

Resilience starts long before a system fails. ICT risk control means setting up your defenses before an outage happens, rather than just reacting once things break.

Instead of scrambling during a crisis, companies proactively protect themselves by mapping out assets, catching vulnerabilities early, and keeping a constant eye on their systems. It is the difference between having a fire code in place versus just calling the fire department when the building is already burning.

Why Is External Infrastructure Part of the Same Risk System?

Cloud infrastructure, software, data and other external ICT services can support critical functions even though the technology belongs to another company. DORA therefore treats third-party ICT dependency as part of the regulated entity's own ICT risk. Outsourcing technology does not mean outsourcing regulatory responsibility.

Which Regulated Crypto Services Does DORA Cover?

DORA applies to MiCA-authorised Crypto Asset Service Providers (CASPs) and issuers of Asset Referenced Tokens (ARTs), while other regulated entities involved in crypto services can fall within its scope through categories such as credit institutions or electronic money institutions.

Practical Example: An Outage Takes a Crypto Platform Offline

Scenario: NorthPeak Crypto is a fictional MiCA-authorised CASP. Its cloud provider has a regional outage.

Does DORA Mean a Service Should Never Go Down?

DORA does not guarantee zero downtime or eliminate cyberattacks, software failures, data problems or outages at third-party providers. Its practical purpose is to require regulated firms to prepare for disruption, control ICT risk, maintain critical functions where possible and recover in an organised way when prevention does not stop something bad from happening. It's like when your friend warns you not to drink another beer but then removes you from the bar if you fail to comply. That way you can recover in an organized way, just like DORA is designed to do.

Disclaimer: The content provided in this article is for educational and informational purposes only and should not be considered financial or investment advice. Interacting with blockchain, crypto assets, and Web3 applications involves risks, including the potential loss of funds. Venga encourages readers to conduct thorough research and understand the risks before engaging with any crypto assets or blockchain technologies. For more details, please refer to our terms of service.

This week, football fans finally got their answer on who would win the 2026 Ballon d’Or, and, as always, there was a bit of drama and debate around the results. However, something interesting happened off the pitch.

Several Polymarket accounts predicted the exact top five before the ceremony and made nearly $200,000 in profit. Naturally, people have questions.

Quick Reminder

Polymarket is a prediction market where users can bet on the outcomes of almost any real-world event, from political elections to sporting competitions. Its transactions are publicly traceable on the Polygon blockchain, allowing anyone to examine betting activity, including amounts, timestamps and wallet addresses.

To make the bets, Polymarket uses USDC and shares representing the different possible outcomes. Their prices reflect the market’s implied probability, meaning that a share priced at $0.70 suggests a 70% chance of that outcome (according to the bettors), and a winning share pays out $1. 

On the other hand, the Ballon d’Or is one of football’s most prestigious individual awards, recognising the best player of the year.

So, as you can imagine, people have been pretty active on Polymarket around it.

What Happened?

Just three days before the ceremony, on October 23, media outlet Upside reported suspicious betting activity across several Polymarket accounts.

Those accounts collectively wagered $264,000 on the same specific scenario for the Ballon d’Or top 5 ranking:

1. Harry Kane
2. Kylian Mbappé
3. Lamine Yamal
4. Rodri
5. Lionel Messi

As blockchain transactions are public, the bets were traceable before the ceremony even began and open to public scrutiny. So, naturally, the situation raised questions and curiosity.

A second investigation published on October 28 by JDC added another layer to the story with an analysis of 150 wallets through Polymarket’s public API. 

When taking a closer look, investigators noticed that kraben006, the first suspicious account identified, placed its first bets on Harry Kane to win the Ballon d’Or on October 1, just three days after the jury’s voting deadline had passed on September 28.

Shortly afterwards, Polymarket opened the market on whether Mbappé would finish above Yamal. That same account, alongside newly created ones, started betting on Mbappé, even though the market initially gave him relatively low chances of finishing ahead of the Spanish player.

Then, on October 9, the odds shifted significantly without any apparent news to explain the change. The probability of Mbappé finishing ahead of Yamal jumped from around 17.5% early on October 9 to 45% by midnight, and by October 22, the market had moved from strongly favouring Yamal to giving him just a 28% chance of finishing above Mbappé. The market for Kane winning the Ballon d’Or also increased from 54% to 64% on October 9, again without any clear news explaining these sudden changes.

On October 19, Polymarket opened the possibility of betting on players’ exact positions in the final ranking, and this is where the real fun began. That same night, the suspicious accounts started betting on the same five-player scenario.

There is an interesting detail here: kraben006 sold its existing position on Kane winning to bet on the exact top 5 ranking instead. This appears to be pretty odd as it was a considerably riskier strategy (unless, you already know the results).

What is also interesting is that 12 of the suspicious accounts had been created in October, with seven reportedly not betting on any other markets. Several accounts also placed bets shortly after being created.

The investigations additionally identified a recurring pattern as different accounts would bet for a few days before stopping, while another account continued the same strategy, which could suggest that multiple accounts were controlled by a single person.

Though, the entire activity was not limited only to accounts created shortly before the ceremony. Some of the largest positions were placed by wallets which entered the market between October 12 and 20, with two addresses accounting for approximately $46,000 in bets on the exact-position markets, and 16 of the 25 wallets identified by JDC only entered those markets on the day of the ceremony. This distinction matters because not every successful bettor (if any) necessarily had access to advanced information.

So, as you can imagine, once this whole situation was spotted, people became curious about what was happening behind the scenes and were waiting even more for the Ballon d’Or ranking to be revealed.

Time for the Results

Fake drumroll sounds… (yes, you have to imagine it).

The ranking was exactly as predicted!

On Monday, October 26, we got the official 2026 Ballon d’Or ranking. Harry Kane won the trophy, followed by Mbappé, Yamal, Rodri and Messi, in precisely the order mentioned previously.

By winning the related bets, the accounts reportedly made nearly $200,000 in profit on their combined $264,000 in stakes, without losing a single bet among the markets investigated.

Yeah, not too bad!

However, the reported profits vary depending on which wallets and markets are included in the analysis. Upside’s investigation focused on 12 suspicious accounts and nearly $200,000 in combined profits, while JDC separately identified 25 wallets that predicted the four positions behind Kane and analysed three wallets that made close to $90,000 in total. These figures describe different groups and shouldn’t be added together.

On top of this, the second investigation identified several particularly profitable wallets. One address, 0x8d33, reportedly made around $31,500 by betting heavily on Mbappé finishing above Yamal, but without trading on any other events. Another account, OuldLm3alem, reportedly made approximately $31,000 after placing several bets on the exact rankings and settling its positions shortly after the results, and a third wallet, 0xdd97e6, earned around $25,000. Together, these three wallets generated close to $90,000 in profits on Ballon d’Or markets alone. 

So, Lucky Guess or Leaked Information?

Predicting the Ballon d’Or winner is one thing, but getting the entire top five right is another.

The accuracy of the predictions, the difficulty of getting this exact scenario right, the timing and the unusual betting patterns have raised concerns about possible insider information. And as you may know, this isn’t the first time that prediction markets have raised such concerns, although Polymarket prohibits trading based on certain confidential information obtained from people who are required to keep it secret. 

However, as it does not require users to provide identity documents, it is difficult to establish who controls a particular wallet. The accounts’ owners remain unidentified, and there is no proof that confidential information was leaked or that the accounts belonged to the same person. The unusual activity is certainly worth investigating, but suspicious patterns alone don’t establish wrongdoing.

Maybe we should keep an eye out for those accounts, just in case they try their luck with predicting next year’s Champions League or Ballon d’Or.

Disclaimer: The content provided in this article is for educational and informational purposes only and should not be considered financial or investment advice. Interacting with blockchain, crypto assets, and Web3 applications involves risks, including the potential loss of funds. Venga encourages readers to conduct thorough research and understand the risks before engaging with any crypto assets or blockchain technologies. For more details, please refer to our terms of service.

The EU's Digital Operational Resilience Act goes by DORA for short. You'll also see it cited as Regulation (EU) 2022/2554. It was signed off in December 2022, and firms then had until 17 January 2025 to comply.

Around 22,000 financial firms are in scope, by industry estimates. Banks and insurers are on the list, and so are crypto exchanges. The core idea is that a firm should be able to take a tech failure and carry on, or get back up quickly. The rules go into real detail on this. Some incident reports are due within four hours.

Here's how the regulation words it:

“...the ability of a financial entity to build, assure and review its operational integrity and reliability [...] including throughout disruptions.” Regulation (EU) 2022/2554, Article 3(1)

Picture a server failing at 3am. The app should still open. If it doesn't, it should be back within hours, and your balance should read exactly what it did before.

What Does DORA Actually Regulate?

DORA is about ICT risk. ICT is information and communication technology. On a crypto app, think login servers and the engine that matches orders. Add in the databases that hold everyone's balances, plus the network connecting it all.

A buggy update counts as ICT risk. So does a server outage, a cyberattack or a power cut at a data centre two countries away. For a crypto platform, any of these can stop users trading or withdrawing.

Before 2025, the rules on this were scattered across different sectors and countries. Banks faced detailed expectations, while other financial firms often faced very few. The new regulation replaced that patchwork with one set of rules built around five areas:

• ICT risk management: knowing your systems and protecting them
• Incident management and reporting: handling problems and telling supervisors about serious ones
• Digital operational resilience testing: checking defences before a real failure
• ICT third-party risk: managing the outside companies a firm depends on
• Information sharing: exchanging intelligence on cyber threats with other firms

The DORA requirements also apply proportionately. Article 4 lets a five-person start-up work at a different scale from a global bank. Article 26, for example, exempts microenterprises from the threat-led penetration testing covered further down.

Which Crypto Companies Are Covered by DORA?

Crypto is named directly. Article 2(1) runs through 20 types of financial entities. Point (f) is the crypto one, covering crypto asset service providers (CASPs) authorised under MiCA, the EU's Markets in Crypto-Assets Regulation. An exchange counts as a CASP. So does a custody service holding coins for clients, or a broker executing orders for them.

Issuers of asset-referenced tokens (ARTs) sit in the same point. Picture a token backed by a mix of euros, dollars and gold. That's the sort of thing MiCA classes as an ART.

E-money tokens (EMTs) follow one official currency, like a euro stablecoin. Under MiCA, they can only be issued by credit institutions or electronic money institutions. Both of those already sit inside DORA's scope, so EMT issuers are covered through their banking or e-money licence.

Timing matters here. MiCA's transition period, which let some firms keep operating under older national registrations, ended on 1 July 2026 at the latest (earlier in some member states). Any crypto firm still serving EU clients now needs MiCA authorisation, and with it come the operational resilience rules.

Venga is one example. In July 2026, Venga announced that Spain's National Securities Market Commission (CNMV) had granted the licence leaving it authorised under MiCA. DORA applies to Venga as a result.

What Does Digital Operational Resilience Mean for a User?

Picture a normal ten minutes on a crypto app. You log in and check your balance. Maybe you cancel an order, withdraw €200 and scroll back through last month's transactions.

Behind every one of those taps there's a stack of servers, databases, cloud hosting and payment links. Operational resilience is the platform's ability to keep that stack running, or get it back up, when one piece falls over.

A fire drill is a decent comparison. Offices run them on quiet Tuesdays with no smoke anywhere, and a real alarm then goes a lot more smoothly. DORA wants the same habit for digital systems.

How DORA connects to everyday user experience

How Must Companies Prepare for Technology Failures?

Step one is a map. Article 8 is the starting point. Firms have to write down every system and information asset they use, along with each outside service they rely on. The list can't just sit in a drawer, either. It has to be kept up to date. For an exchange, it runs from the wallet systems to the company that sends out two-factor login codes. This inventory is the base layer of the firm's ICT risk management framework.

Why bother? The weak point is often something nobody remembered was there. An old test server that's still hooked up to live data is a classic example. So is a supplier's plug-in nobody switched off when the contract ended.

Next comes protection. Most of the measures here won't surprise anyone who's worked in IT, starting with limits on who can reach which systems. Patching is in there, as is encryption of client data, along with ordinary good security practices. Detection matters as well. A problem caught within minutes is far easier to contain than one discovered on Monday morning.

Then comes the plan for when prevention fails. Firms are expected to have:

• a business continuity policy for critical functions
• response and recovery plans
• backup and restoration procedures, with backups restored on systems kept separate from the originals

Backups also have to be tested. A backup nobody has ever tried to restore is more of a hope than a plan.

Responsibility sits at the top. Article 5 puts "the ultimate responsibility" for ICT risk on the management body. The board owns this one, and the IT team can't be left holding it alone.

What Happens When a Major ICT Incident Occurs?

Firms have to log ICT-related incidents as they happen, small ones included, and then grade how serious each one is. A login page that's slow for five minutes is one thing. A two-hour outage hitting thousands of clients is another.

Article 18 lists what goes into that call. Firms look at the number of clients affected, how long it lasts and how many EU countries it reaches. Data loss counts, as do the criticality of the services hit and the cost.

Once an incident is classed as major, the firm reports it to its competent authority. For a Spanish CASP, that's the CNMV. The reporting requirements run in stages under the EU's technical standards:

• Initial notification: within 4 hours of classifying the incident as major, and no later than 24 hours after the firm became aware of it
• Intermediate report: within 72 hours of the initial notification, updated as the situation develops
• Final report: within one month of the latest intermediate report, including the root cause

Users get a look-in too.

Article 19(3) says clients must be told "without undue delay" when a major incident affects their financial interests, along with what's being done to limit the damage.

Why this matters: Anyone who's stared at a frozen app during a price swing knows the worst bit is not knowing. Under DORA, a regulated platform has a deadline for briefing its regulator and a duty to keep affected users in the loop.

Why Does DORA Regulate Cloud and Other Technology-Provider Risks?

Open up a typical crypto platform and you'll find other companies' technology all the way down. The servers might be rented from a cloud provider, identity checks handled by a verification specialist and customer emails sent through yet another service, with security tools licensed from someone else.

Each of those is a link in a chain. If a link further down fails, the outage surfaces at the platform the user actually sees, even though the platform itself did nothing wrong.

Outsourcing doesn't let a firm off the hook.

Article 28 says it stays "fully responsible" for compliance, whoever runs the servers.

There's paperwork too. Every contract with an outside ICT supplier goes into a register. Risks get assessed before signing. Contracts have to meet specific requirements, and critical services need a tested exit strategy. An exit strategy is the plan for switching suppliers or bringing a service in-house if a provider fails or stops performing.

There is a wider concern as well. Plenty of financial firms rent from the same handful of cloud companies. When one of those companies has a bad day, banks, brokers and crypto apps can all wobble on the same afternoon.

So DORA puts the biggest suppliers under the direct watch of the European Supervisory Authorities (ESAs). That's the umbrella name for EBA, ESMA and EIOPA, the EU agencies that look after banking, securities markets and insurance. The first list landed on 18 November 2025, when the ESAs designated 19 critical ICT third-party providers. Big cloud and data centre companies are on it. Their risk management and governance now get examined at EU level.

How Are Systems Tested Before a Real Failure Happens?

Waiting for an attacker to find the gaps is the expensive way to learn about them. Under DORA, firms test on a fixed routine and go hunting for problems themselves.

Each covered firm other than a microenterprise needs a written testing programme for digital operational resilience. Article 24 sets the minimum pace at once a year for systems behind critical or important functions.

Article 25 gives a menu of tests. Vulnerability scans are on it. So are network security reviews and scenario-based tests, where a team plays out something like a data centre fire on paper. Compatibility and performance tests appear too, along with penetration testing, which pays specialists to break in like a real attacker would. A small firm won't use the whole menu. Size and risk profile decide how much applies.

Some larger firms go further. Those selected by their supervisor must run threat-led penetration testing at least every three years, which simulates the tactics of real criminal groups against live systems.

Real incidents show why this matters. Take the September 2026 Bitget hack. Investigators suspect the attackers got in through a zero-day flaw, a bug nobody knew about, in a security product Bitget bought in from another company. No test catches everything. Regular testing does cut down the vulnerabilities sitting there unnoticed.

The rules also support information sharing on threats. Firms can exchange intelligence on cyberattacks, such as warning signs and attacker techniques, within trusted groups, so one firm's bad day can help others prepare.

How Is DORA Different From MiCA From a User's Perspective?

From the user's side, MiCA and DORA answer two different questions.

MiCA's question is who gets to offer crypto services in the EU, and on what terms. It covers CASP authorisation, conduct towards clients, custody of client assets, crypto-asset white papers and the rules for ARTs and EMTs.

DORA's question is narrower. Say a licensed exchange goes offline for six hours. MiCA's concern is whether that exchange deserved its licence and treats clients fairly. DORA's concern is what its systems, backups and suppliers did during those six hours.

MiCA vs DORA at a glance

There's a direct bridge between the two. MiCA's Article 68(7) tells crypto-asset service providers to use "resilient and secure ICT systems" as required by DORA.

Liability shows where the line falls. Under MiCA's custody rules, a CASP holding crypto for clients is liable for losses from an incident attributable to it, capped at the market value of the assets when they were lost. DORA has no compensation rules of its own.

Why this matters: MiCA decides who's allowed to run the shop. DORA cares whether the tills still work when the power flickers. A regulated platform answers to both.

Practical Example: A Third-Party Outage Takes a Crypto Platform Offline

This one's made up. The steps, though, track what DORA actually asks for. An EU-authorised crypto exchange runs its account access and transaction processing on an external cloud provider.

• 09:12, the outage begins. A fault at the cloud provider knocks out part of the exchange's infrastructure. Logins fail for some users. Orders hang. Withdrawals pile up in a queue.
• 09:15, detection and classification. Monitoring alerts fire within three minutes and the incident team gathers. They run the incident against the official criteria: around 40,000 clients affected, core services down, no fix in sight. At 09:50 it's classified as major.
• 10:05, users are told. A status page goes up and an in-app banner explains what's down. It confirms client assets are safe and says when the next update is due.
• 13:30, the regulator is notified. The initial notification reaches the national competent authority inside the 4-hour window.
• 14:40, service is restored. The continuity plan moves critical services to a backup environment. Before withdrawals reopen, the team checks balances and order records against its data.

Within 72 hours. An intermediate report goes in.

Within a month. The final report names the root cause (a faulty configuration change at the provider, say) and what has changed since.

Afterwards. The exchange goes back to its cloud contract to check what the provider promised on recovery times, then runs a test move of its order engine to a second provider. Its recovery plans get rewritten with what the team learned.

Why this matters: Users still couldn't trade for five and a half hours, and DORA did nothing to prevent that. What it did was make sure the backup environment, the status page and the regulator's deadline were all sorted out months before 09:12.

What Does DORA Not Guarantee for Users?

DORA cannot make technology fail-proof. Cloud regions go down and software has bugs. Attackers also keep changing their tactics. A regulated platform can still have an outage.

It also doesn't create a compensation scheme. Say bitcoin drops 8% while the app is down and you can't sell. DORA has nothing to say about that loss. MiCA's custody liability covers lost assets, not missed trades, so any claim would rest on the platform's terms or national law.

Its reach has limits too. Self-custody wallets sit outside it. So do unregulated platforms based outside the EU.

For regulated firms, the bar has moved. Outages are expected to be planned for in advance. While one is under way, there's a process to follow. And the route back to normal service has to have been tested before anyone needs it.

Disclaimer: The content provided in this article is for educational and informational purposes only and should not be considered financial or investment advice. Interacting with blockchain, crypto assets, and Web3 applications involves risks, including the potential loss of funds. Venga encourages readers to conduct thorough research and understand the risks before engaging with any crypto assets or blockchain technologies. For more details, please refer to our terms of service.

Open a custodial crypto app and you'll see a balance, a buy button and a withdraw button. You won't see a private key anywhere. On a custodial platform, the keys and other means of access sit with the provider, not with you.

That arrangement puts obligations on the provider. Under the EU's crypto rules, a platform offering crypto custody has to protect client assets and keep a record of who owns what. It also has to hold client crypto apart from its own, return it on request and answer for certain losses.

Every one of those duties stops somewhere. This guide goes through where.

What does it mean for a platform to hold your crypto?

The legal wording is a little dry here. In the EU’s crypto regulation, custody means safekeeping or controlling, on behalf of clients, either the crypto-assets themselves or the means of access to them. In most cases that means of access is a private key. Names and passwords mean nothing to a blockchain (it only cares whether a transaction carries a valid signature from the right key).

Tap "withdraw" in a custodial app and what leaves your phone is a request, nothing more. The provider's custody system receives it, runs its checks, and only then signs with a key it holds for you. On larger platforms, that signing often happens from a shared hot wallet, in batches.

Think of a theatre cloakroom. The attendant hangs your coat somewhere at the back, out of sight, and the numbered ticket in your pocket is your only proof it's yours.

The EU's Markets in Crypto-Assets Regulation (MiCA) names ten crypto-asset services, and custody and administration of crypto-assets is first on the list (Article 3(1)(16), point (a)). Firms are authorised for specific services from that list, not for "crypto" in general. A crypto-asset service provider (CASP) whose licence covers only, say, exchanging crypto for euros can't start holding client coins until custody is added.

How does platform custody differ from self-custody?

Mostly, it's a question of who holds the keys. The chores come with them. Someone has to back the keys up and approve each transaction. Someone also has to deal with it when access goes missing.

In self-custody, that someone is you. A seed phrase, usually 12 or 24 words, will rebuild the wallet on a new phone. Lose it without a backup and there's no support desk to call.

A custodian takes those chores off your hands. Security becomes its problem, and so does recovery, usually through identity checks rather than a list of words. The price is dependence. If the company has an outage or pauses an account for a review, you wait on it. (For a side-by-side of the everyday differences, see our guide to custodial and non-custodial wallets.)

Neither model removes risk. The table below shows where each one places it.

Platform Custody vs Self-Custody: Where Responsibility Sits

What obligations does a platform take on as custodian?

MiCA's custody rules sit mainly in Article 75, and they start with a contract. A CASP providing custody has to sign an agreement with each client setting out its duties and responsibilities.

The agreement has to include, at minimum:

• the identity of both parties and a description of the service
• the custody policy and the security systems used
• the means of communication, including how clients are authenticated
• the fees, costs and charges, and the law that governs the agreement

Worth knowing: The custody agreement is usually part of a platform's terms and conditions rather than a separate document. Its custody and liability sections are where these duties are written down for that particular provider.

Record-keeping is the other half. The custodian keeps a register of positions for each client and records every movement promptly. Clients receive a statement of their positions at least once every three months, and on request, listing the crypto-assets held, their balance and value, and any transfers in the period.

How should client assets be kept apart from the platform's?

Segregation is the rule that keeps client crypto separate from the custodian's own holdings. MiCA requires it at two levels.

Operationally, client holdings and their means of access have to be clearly identified as belonging to clients, including on the blockchain itself. Legally, client crypto-assets sit outside the custodian's estate, so its creditors have no claim on them, in particular if it becomes insolvent.

The collapse of FTX in November 2022 shows why the rule exists. At the trial of its founder, Sam Bankman-Fried, prosecutors said customer deposits had been used to cover losses at Alameda Research, a sister trading firm. He was convicted on all seven counts in November 2023, and FTX customers were left waiting on bankruptcy proceedings to recover their funds.

Can the platform use client crypto?

Not for its own account. Article 70 of MiCA requires a CASP holding client crypto to safeguard clients' ownership rights and to prevent the use of their assets for its own purposes.

That rules out treating deposits as company money, whether by trading with them or using them to plug a gap elsewhere in the business. The attendant can store the coat but can't wear it.

The register of positions and the quarterly statements back this up. They give clients, and supervisors, a record to check holdings against.

What happens when you want to withdraw your crypto?

Article 75 requires custodians to have procedures for returning crypto-assets, or the means of access to them, to clients as soon as possible.

That wording leaves room for delays with a legitimate cause. A withdrawal to a new address can be held for a security review, and anti-money laundering checks can add time. The network itself can stop as well. Solana had exactly this problem on 6 February 2024, when block production halted at around 10:22 UTC and didn't restart for roughly five hours. South South Korea’s Upbit suspended deposits and withdrawals of SOL and several Solana-based tokens during the outage.

A delay with a stated reason fits within the rules. Repeated delays with no explanation are a different matter, and worth raising with the provider.

When is the custodian liable for a loss?

Article 75 of MiCA sets out the liability rule in paragraph 8:

"Crypto-asset service providers providing custody and administration of crypto-assets on behalf of clients shall be liable to their clients for the loss of any crypto-assets or of the means of access to the crypto-assets as a result of an incident that is attributable to them." MiCA, Article 75(8)

That sentence carries two limits. First, the incident has to be attributable to the custodian. If the custodian can show an event occurred independently of its service and operations, it isn't liable. MiCA's own example is a problem inherent in the operation of a distributed ledger that the custodian doesn't control.

Second, liability is capped at the market value of the lost crypto-asset at the time the loss occurred. Later price movements don't change that figure.

Large custody incidents do happen. On 21 February 2025, attackers took around $1.4 billion in ether from one of Bybit's cold wallets, in a theft the FBI attributed to North Korean hackers. Bybit said client assets remained backed 1:1 and absorbed the loss itself.

Why this matters: MiCA liability turns on the cause of a loss. A custodian answers for failures in its own systems and processes, up to the value of the lost assets at the time.

What changes if the platform uses another custodian?

Some platforms use a specialist custody firm to hold part or all of their clients' assets. This is sub-custody, and MiCA permits it on two conditions.

The other firm must itself be a CASP authorised to provide custody, and the platform has to tell clients that it uses one.

A single brand in the app doesn't always mean a single company holds the assets. The terms should name the entity holding client crypto, and the European Securities and Markets Authority (ESMA) publishes a register of authorised providers for checking a firm's status.

Practical example: losing access after an incident

Laura, a fictional user, holds €5,000 in crypto on a custodial platform. The platform reports a security incident in which the means of access to part of its client holdings, including Laura's, has been lost. The outcome depends on what the investigation finds.

Scenario A: a failure on the custodian's side

The investigation traces the incident to the platform's own systems, for example an unpatched vulnerability or a flaw in how it managed keys.

That makes the loss attributable to the custodian, which is exactly the situation Article 75(8) covers. Laura's claim would be based on the market value of her crypto at the moment it was lost.

Worth knowing: If Laura's crypto was worth €5,000 when it was lost and €6,500 a month later, the cap is the €5,000 figure. Liability is fixed at the time of the loss, not at today's price.

Scenario B: a fault in the network itself

This time the cause is a fault inherent in the blockchain, outside any single custodian's control.

Here, liability isn't automatic. If the platform can show the event occurred independently of its service and operations, MiCA doesn't treat the loss as attributable to it. What Laura recovers then depends on the facts, her custody agreement and any other terms that apply.

Same balance, same platform, two different outcomes. The cause of the loss decides which one applies.

What does platform custody not guarantee?

A regulated custodian protects access to crypto-assets. It doesn't protect their price.

Custody doesn't guarantee that holdings keep their value, that the service never goes offline or that a blockchain never fails. Nor does every incident lead to compensation, since liability depends on the cause.

Self-custody has limits of its own, which our article on what a hardware wallet does and doesn't give you covers. Custody is best read as a defined set of duties, and knowing where they start and stop makes one platform easier to compare with another.

Disclaimer: The content provided in this article is for educational and informational purposes only and should not be considered financial or investment advice. Interacting with blockchain, crypto assets, and Web3 applications involves risks, including the potential loss of funds. Venga encourages readers to conduct thorough research and understand the risks before engaging with any crypto assets or blockchain technologies. For more details, please refer to our terms of service.

KYC and AML are also frequently used in the same sentence and some people start to believe they mean the same thing. They're not. KYC (Know Your Customer) is a process that involves determining who you are and verifying your identity. 

AML (Anti-Money Laundering) is the big picture. AML is the entire framework a provider adopts to evaluate, track and act on money-laundering and terrorist-financing (AML/TF) risks.

There is one more term that you should know. In EU law, the majority of what "KYC" is commonly referred to is actually customer due diligence (CDD). It's the same concept, just a bit more specific.

What Is the Difference Between AML and KYC? 

Based on the meanings of these, we can infer that KYC is a precursor to AML. A provider cannot determine whether or not a customer's activity is legitimate without knowing who that customer is. Once your identity is confirmed, the larger AML process kicks in. 

It may be a risk assessment, continuous transaction surveillance, further investigation and, if required by law, a suspicious activity report to the National Financial Intelligence Unit (FIU). The following is an explanation of how the two are used in practice.

The KYC process is not a box to be ticked on sign up. It's a base that continues to be utilised for as long as you are a customer. It may also remind you to update the information at any time.

Which AML/KYC Rules Apply to Crypto Services in the EU? 

A crypto-asset service provider (CASP) that has been authorised by MiCA is part of the EU's AML/CFT framework. They are obliged to request AML/KYC information, just like banks. 

The main duties of AML come from the EU Anti-Money Laundering Directive (2015/849). This directive is written into the national law of each EU member state, but how they are executed can differ from country to country.

Crypto transfers have their own layer. Regulation (EU) 2023/1113, the recast Transfer of Funds Regulation, has applied to relevant crypto-asset transfers since 30 December 2024. That's where the EU's crypto Travel Rule comes from.

And there's a change on the horizon. The Anti-Money Laundering Regulation, (EU) 2024/1624, will generally apply from 10 July 2027. It replaces the national patchwork with one directly applicable rulebook. 

Why Is Identity Verification Needed If Blockchains Are Transparent? 

Blockchains are public ledgers, where everyone has access to transaction details. They don't know who is behind these addresses. An address is a string of characters. It's not a name, passport or company registration. Control hundreds of addresses using one person.

You will see the transaction when you view the transaction history. KYC associates it with a flesh-and-blood person or company. AML needs both. This is also how CASPs operate on a risk-based approach. Not all customers are subjected to the same level of investigation.

Providers weigh four kinds of factors, including who the customer is, their location, transaction size/frequency, and product. Low risk = normal checks. The more you have the more you are at risk.

What Information Can a Crypto Platform Ask For? 

There's no universal checklist. It depends on the provider, the country and your risk profile. Most requests fall into these categories:

• Identity details: full name, date of birth, nationality
• An identity document: passport or national ID, often with a selfie
• Address information: sometimes with proof of address
• Purpose of the relationship: how you plan to use the account
• Occupation or business activity
• Beneficial ownership: for companies, who ultimately owns or controls them
• Source of funds: usually when risk is higher

The first three are standard for almost everyone. The rest depend on context.

Does KYC End After an Account Is Opened? 

EU guidelines require that providers maintain customer data and track transactions during the course of the business. The purpose is to find out if your activity is still in keeping with what they know about you.

Imagine that you registered to make a €200 monthly investment. A year later there is an influx of €80,000 from several new sources. Nothing's necessarily wrong. However, the profile is no longer relevant and the provider might ask.

Why Can a Platform Ask About the Source of Funds? 

Where the particular money or crypto was obtained is known as source of funds. It is not the same as source of wealth, which is the way in which you have created your total assets. 

Only a few platforms will require source of funds information during large deposits, changes in usage or if you are from a higher risk area. A provider might want to know where you got specific cryptos or euros, and provide proof of:

• Pay slips or bank statements
• Use any type of trade history or account statements from another exchange
• This document will provide evidence of a property or business sale.
• Cryptocurrency details that include record of where the crypto has been sourced from.

If you have had crypto for a long time, store the previous crypto exports and tax statements from the exchange. They are there to help you get your stressful process from a five-minute upload.

What Does the Travel Rule Change for Crypto Transfers? 

The Transfer of Funds Regulation requires CASPs to obtain and provide certain information on the originator (sender) and the beneficiary (recipient) of a covered transfer. Names, wallet address/account number; additional originator information like address or ID number.

This is true between two CASPs, regardless of quantity. Unlike some payment rules, there is no minimum limit for using crypto. This data that they gather isn't recorded on the blockchain. 

It flows from provider to provider via distinct compliance routes. Your on-chain transaction is identical to yours. Self-hosted wallets are not handled the same way. 

No provider is available on the other side with whom to exchange information, so CASPs collect the information. If the amount is transferred over €1,000 it will also verify whether the address you are using is owned or controlled by you.

What Happens If a Transaction Is Flagged for Additional Review?

Being flagged doesn't necessarily indicate an illegal action. Most platforms have a monitoring system that alerts for patterns or risk factors, such as a large volume, links with risky addresses and money moving in and out very quickly. 

An alert is simply a call for someone to investigate. Depending on the circumstances, the provider may ask for further information, check transactions, could postpone payments or reverse transactions. All of this doesn't happen without work. 

But if there is still a suspicion, the provider might be obliged to report to the FIU. If so, it is usually not allowed to tell you, and this is why some responses may be ambiguous. When flagged, respond promptly and succinctly, using documents. Most reviews are done once the context is present.

Practical Example: Sending Crypto From a Self-Hosted Wallet to an Exchange 

Let's assume there's a fictional user called Martin. This is Martin's first full KYC with an EU regulated CASP last year. Martin would like to send Bitcoin from his own self-hosted hardware wallet to his exchange account today. 

The exchange already has a clear idea of who Martin is. However, the AML tests don't end there. The provider must evaluate the relationship since the money is being sent from an outside wallet that is self-hosted. They have to determine if it is a real wallet belonging to Martin or not.

They may temporarily suspend the deposit if there are any risk factors or if the amount of the transfer is less than expected. This is because they want to hear more before they accept his story.

What Do AML and KYC Not Guarantee for Users?

AML and KYC are rules, and like every rule, they have their limitations. Passing KYC doesn't make a platform risk-free. They cover financial-crime controls, not market swings or how a provider runs its business.

AML can't catch everything. Fraud, stolen funds or laundered money can still slip through a regulated service. Also, there's no single EU-wide process yet. Until AMLR applies, national rules and provider risk policies differ, leading to the differences we see.

While AML and KYC are great protection tools, they won't stop a scam you authorise yourself. If someone talks you into sending crypto, KYC doesn't undo it. In the end, you still have a role to play in protecting your coins.

Disclaimer: The content provided in this article is for educational and informational purposes only and should not be considered financial or investment advice. Interacting with blockchain, crypto assets, and Web3 applications involves risks, including the potential loss of funds. Venga encourages readers to conduct thorough research and understand the risks before engaging with any crypto assets or blockchain technologies. For more details, please refer to our terms of service.

When MiCA (the Markets in Crypto Assets rulebook) was first introduced in 2020, the entire crypto community celebrated the possibility that MiCA would bring clarity to the regulatory issues plaguing the crypto world. 

MiCA is now officially referred to as (EU) 2023/1114 and it legally became effective on 29 June 2023. There have been many key dates throughout the process of developing the MiCA regulations. After June 2023, there have been several significant dates in the evolution of MiCA. 

Existing crypto-asset service providers will be able to utilise a national transitional regime for a certain amount of time, dependent upon their location of operation. The EU wide cap on the length of the national transitional regime is 1 July, 2026. As of today, this date has passed. 

In this article, you will see how this applies and which dates have influenced the MiCA implementation thus far.

Why Does MiCA Have Several Different Implementation Dates?

MiCA is not just one book of rules covering many types of cryptocurrency and related products. Rather, MiCA is made up of three sections. The first section relates to stablecoin type tokens. The second section deals with other cryptocurrencies, such as utility tokens. 

The third section addresses the service providers who buy, hold, and transfer those items. Since each group required varying amounts of preparation time, the EU staggered the start date. Only three terms are necessary to understand the remainder:

• Entry into force: MiCA formally becomes EU law. It's on the books.
• Application date: specific obligations actually start binding specific market players.
• Transitional deadline: the last day an existing business can keep going under its old setup while it moves over.

The classic mix-up? Thinking "in force" means "comply today". It doesn't. That gap causes most of the confusion.

MiCA Implementation Dates at a Glance.

29 June 2023: MiCA Enters Into Force

MiCA was published in the Official Journal of the European Union on 9 June, 2023. Just 21 days later, on 29 June, MiCA formally became law. Was this the moment when crypto regulation was implemented uniformly across Europe? Almost.

It was the moment when the MiCA rulebook was placed on the books. At that point, exchanges, wallets, and token-issuing companies did not have to implement MiCA rules because it wasn't yet enforceable. 

For example, if you owned Bitcoin back then, nothing happened with your app. That's typical for this stage of enforcement — most significant changes happen at a later time.

30 June 2024: The ART and EMT Rules Start Applying

The first time the EU took real action regarding the regulatory status of cryptoassets was with regard to these two titles. 

• Title III applies to "Alternative Retail Tokens" (ART) which are tokens referencing a particular asset basket, whether it is an array of different types of cryptocurrencies, commodities, or other assets. 
• Title IV applies to E-Money Tokens (EMTs), also known as stablecoins which are pegged to a single fiat currency. 

The reason for issuing regulations concerning stablecoins first is because they act very similarly to the fiat we use every day. When a stablecoin's peg becomes unstable, the effects could be felt by ordinary citizens quickly. 

As a result, the EU prioritised protecting consumers in this space before others. From this date forward issuers would need to have their products approved through the appropriate process, maintain sufficient reserves and produce compliant white papers.

30 December 2024: Most of MiCA Becomes Applicable

This is one of the biggest dates in the history of MiCA. In fact, when people say MiCA went live, they are usually referring to December 30, 2024. Beginning January 1st, 2026, the remaining framework will be in place, with all licensing and conduct standards for CASP's to follow their own provisions.

• Licensing and conduct rules for crypto-asset service providers (CASPs)
• Rules on white papers and marketing for other crypto assets
• Market abuse rules, such as bans on insider dealing and manipulation

New firms now need a MiCA licence before offering crypto asset services in the EU. No license, no launch. This MiCA date brings about passporting rights to licensed firms. 

One licence allows the firm access to all member states of the European Union and beyond into the European Economic Area (EEA). Prior to MiCA, a firm may have been required to register separately in each member state.

Why Did Early 2025 Still Matter for Stablecoins?

The stablecoin rules had been in effect since June 2024. Yet plenty of EU platforms still listed stablecoins from unauthorised issuers at year-end. So on 17 January 2025, ESMA published a statement with the European Commission's Q&A. 

The message: trading non-compliant ARTs and EMTs could count as offering them to the public. That breaches MiCA. National authorities were told to ensure CASP compliance as soon as possible and no later than the end of Q1 2025.

In practice, ESMA expected platforms to restrict new purchases by the end of January 2025. "Sell-only" access could run until the end of March, so users could exit or convert. That's why some well-known stablecoins quietly vanished from EU order books around then.

Why Did CASP Transitional Deadlines Differ Across EU Countries?

Thanks to Article 143(3), CASPs that were lawfully providing services under national law before 30 December 2024 keep going. They could continue until 1 July 2026, or until they were granted or refused MiCA authorisation, whichever came first.

The catch? Each Member State could shorten that window or skip it entirely. They had to tell the Commission and ESMA by 30 June 2024. The result was a patchwork. ESMA's published list showed grace periods ranging from roughly 5 to 18 months. 

Germany and Ireland went with 12 months. France took the full 18. Why shorten it? Countries whose old national rules were lighter than MiCA often chose shorter windows.

Less time under weaker rules means less risk for users. Some countries added filing cutoffs too. Miss the application date, lose the grace period. One more limit: firms relying

1 July 2026: The Maximum CASP Transitional Period Ends

The EU-wide grandfathering window is closed everywhere. ESMA flagged it early. In April 2026, it confirmed there would be no extensions. On 23 June 2026, it set out exactly what unauthorised firms had to do.

For non-compliant entities, the expectations were clear:

• Stop onboarding new EU clients
• Stop marketing and soliciting EU users
• Limit services to selling, transferring or closing existing positions
• Keep custody only as long as an orderly exit requires

That's consumer protection doing its job. Users got time to sell or move their crypto assets, rather than waking up to a frozen account. Firms outside the EU got a reminder too. They can't serve EU clients, except under the narrow reverse-solicitation exemption.

So what does this mean for you? Check the register. ESMA keeps an interim MiCA register of authorised CASPs. Industry trackers counted around 320 names on it in early August 2026. That number keeps moving, so check the live list.

31 December 2027: Why Does MiCA Still Have a Future Deadline?

December is not MiCA part two. Article 143(2) covers crypto assets other than ARTs and EMTs that were already admitted to trading before 30 December 2024. Think older, established tokens.

For these legacy tokens, trading platform operators must make sure a compliant white paper is drawn up, notified and published by 31 December 2027. ESMA confirmed this in Q&A 2654 in autumn 2025.

Their marketing, however, has had to follow MiCA since 30 December 2024.

What this date does not do:

• It doesn't extend CASP grandfathering to 2027.
• It doesn't push back any other deadline.
• It doesn't cover tokens listed after 30 December 2024. Those need one already.

Small twist: if a legacy token isn't on any trading platform, it may never get a MiCA white paper at all.

Practical Example: How the Dates Affected a Crypto Platform Operating Before MiCA

In order to demonstrate our hypothetical situation, let's use an example with the fictional BitBag Exchange as our trading platform. This is a trading platform registered as a national platform in an EU member state since 2021 providing both the trade/exchange and custodial functions.

Below is a step-by-step of how these timelines have progressed.

• June 2023 – MiCA legislation comes into force. Although BitBag is a nationally registered exchange (and thus continues to operate), their compliance team begins conducting a gap analysis. However, nothing will change for users at this time.
• 30 June, 2024 - A Euro-denominated stablecoin and a US-Dollar denominated stablecoin are listed by BitBag. At this point, it is the regime regarding the issuers of stablecoins that matters. They check if each of the stablecoin issuers was legally authorised under MiCA.
• 30 December, 2024 – The broader CASP regulations become applicable. Since BitBag provided client service lawfully prior to the cutoff, they reviewed their home country's transitionary provisions. Let us assume the home country has a 12-month transitionary provision.
• Early 2025 - The ESMA stablecoin statement is released. As such, BitBag immediately restricts the sale of the non-compliant stablecoin and subsequently delists it by the end of March 2025.
• 2025/26 - BitBag files for MiCA authorisation. During this time, BitBag can continue to serve clients, however, only in those jurisdictions where their national transitional provision still applies. No passport exists.
• 01-Jul-26 - Either BitBag possesses the correct MiCA authorisations, or it winds down all regulated services that it has no legal foundation to perform.

Which MiCA Dates Still Matter After July 2026?

If you want to know which of the various MiCA dates are most important, you should realise that there is a sequence of legislative milestones related to MiCA rather than a fixed launch date. Therefore, when trying to determine what is relevant for your cryptocurrency business model, you will need to take into account what segment(s) of the cryptocurrency space you are operating within.

The important dates for stablecoin issuance are different from those dealing with legacy crypto assets already admitted to trading. The table below will give you a breakdown of the important dates that matter for different sectors in crypto.

By securing their final licence, companies are finally unlocking the true benefits of passporting across the continent. The MiCA framework is fully active, and the European market is now playing by a unified, safer set of standards.

Disclaimer: The content provided in this article is for educational and informational purposes only and should not be considered financial or investment advice. Interacting with blockchain, crypto assets, and Web3 applications involves risks, including the potential loss of funds. Venga encourages readers to conduct thorough research and understand the risks before engaging with any crypto assets or blockchain technologies. For more details, please refer to our terms of service.

Because of how dynamic the crypto market is, many people tend to forget that Bitcoin and other altcoins don't float in some separate universe. They get bought and sold by the same money that pushes stocks, bonds and currencies around every day.

If rates go up, loans will naturally cost more. If big investors (institutional investors) get excited, demand for crypto tokens can wobble right along with all of it. Let's walk through how crypto has become macro. 

Why Would Digital Assets Care About the Economy at All?

Back in 2015, Bitcoin was mostly forum chatter and a handful of brave miners. Now? It sits in hedge-fund books, spot ETFs and the same apps your cousin uses for Apple shares.

Same investors. Same portfolios. Same decisions. So when cash or bonds suddenly look like the smarter seat at the table, those investors shuffle things around. Tokens get swept into that shuffle too.

How Can Interest Rates Affect Crypto-Assets?

The first thing you need to understand is opportunity cost. Picture a boring government bill paying you 5% for doing basically nothing. Your token pays zero and can drop 10% before Friday. 

When safe money pays well, every risky bet has to work harder to look worth it. There's a second hit, too. Tight policy means pricier loans, and traders running on borrowed cash start trimming. 

Fewer borrowed dollars sloshing around? Usually fewer buyers. Lower rates can work in reverse. However, this is not always the case. 

What Does "Liquidity" Actually Mean?

If you jump on crypto Twitter (X) right now, there's a 100% chance you'll come across the word liquidity. While it gets tossed around on X like confetti, people mean different things when they say liquidity. 

The two main meanings of liquidity are:

• Market liquidity: can you sell a decent chunk without the price lurching? If the order book is thick and the spread is tiny, you're fine.
• Financial (or global) liquidity: this one's bigger. It's about how much cash and credit the whole system has to go around. Bank loans count. So does the Fed's balance sheet.

Why Does Risk Appetite Matter So Much?

Risk appetite is just your tolerance for a bumpy ride when there's a bigger payoff waiting on the other end. In risk-on mode, you may wander off into trading memcoins, stocks, and junk bonds.

Then somebody gets nervous (risk-off) and it runs home to trading only Bitcoin and Ethereum. Tokens live way out on the risky edge, so they usually feel the mood swing early. And hard.

Why Does Crypto Increasingly Move With Equities?

Because the same big players now hold both. The IMF crunched the numbers: Bitcoin and the S&P 500 barely moved together in 2017–2019. By 2020–2021? Correlation had climbed to roughly 0.36 — right as institutions showed up.

The link tends to be strongest with tech and smaller-company stocks. When a fund manager trims tech, tokens may get trimmed too.

Is a Rate Cut Always Bullish?

Short answer? No. A central bank might cut because inflation is cooling nicely. Call that a comfort cut. Or it might cut because growth is cracking or something in the financial system broke. 

That's a "rescue" cut, and investors often go risk-off. Don't just ask whether the bank cut. Ask why. Plus, an expected cut is usually priced in long before it happens.

Which Macro Indicators Are Actually Useful?

The five major macro indicators to look at are:

• Central-bank policy rates and forward guidance
• Inflation (CPI, PCE)
• Growth and labour-market data
• Credit spreads, bond yields and how strong the dollar is
• The VIX, Wall Street's so-called fear gauge

Practical Scenario: One Token in Two Macro Regimes

Meet Zenith (ZEN), a made-up token we'll be using for two macro regimes. 

• Regime A: Inflation is easing. Financing is getting less restrictive. Investors are warming up to risk again. ZEN may draw fresh buyers simply because cheaper money is hunting for returns.
• Regime B: Inflation surprises higher. Rates look set to stay restrictive. Credit tightens and funds cut risky exposure. ZEN may face steady selling. 

Nothing about the project changed, just conditions. That's the macro channel at work.

When Does Macro Fail to Explain Price Moves?

Often, honestly. Macro sets the backdrop, but tokens have their own plot twists:

• Regulation and court rulings
• Exchange failures (FTX in 2022 is the textbook case)
• Protocol upgrades and forks
• Token unlocks or new issuance
• Hacks and security incidents
• ETF and fund flows
• Project-specific news

Any one of these can drown out the macro signal in a single afternoon.

What Does "Crypto Is Macro Now" Really Mean and What Doesn't It Mean?

Crypto is macro now simply means it's no longer self-contained. Global monetary policies, financing conditions and global risk appetite can now affect its moves and shape demand and valuations. However, it doesn't mean cryptos are just leveraged tech stocks, or that one Fed meeting decides everything. These correlations come and go, but crypto is no longer self-contained.

Disclaimer: The content provided in this article is for educational and informational purposes only and should not be considered financial or investment advice. Interacting with blockchain, crypto assets, and Web3 applications involves risks, including the potential loss of funds. Venga encourages readers to conduct thorough research and understand the risks before engaging with any crypto assets or blockchain technologies. For more details, please refer to our terms of service.

If you are an investor interested in crypto strategies, you may want to consider new ways of increasing your holdings. One of the ways to gradually grow your asset amounts is to ensure a steady inflow of funds.

Maybe you are familiar with the dollar-cost averaging (DCA) approach that helps investors reduce risk and minimize the impact of emotions. It is based on investing a certain sum of money following a predetermined schedule, regardless of market ups and downs.

This article also focuses on creating a regular investing routine. However, we’ll discuss how to control different variables and therefore develop different cash flow and price exposure patterns. You’ll learn the pros and cons of investing €50 in BTC and buying a fixed 0.001 BTC monthly.

What Is the Main Difference Between the Two Approaches?

Let’s say you want to invest in Bitcoin on a regular basis. You may explore two options: either put a set amount of funds into an investment product or buy a fixed amount of an asset. The approaches differ in implications for cost and potential returns.

Approach 1. You invest €50 or any other cash sum into BTC every month. The amount of money spent does not change from one period to another. The amount of BTC you get is different each time, since the quotes are not stable.

Approach 2. You buy 0.001 BTC or any other set asset fraction every month. The amount of cryptocurrency you get is the same for every transaction. The euro cost changes, so you require a flexible monthly budget.

How Does Investing a Fixed €50 in BTC Work?

If an investor follows the first strategy and allocates the same 50 euros at each time interval, they don’t have to watch the price of digital assets. It does not matter whether the price grows or declines. That’s the dollar-cost averaging mechanism. The DCA allows buying more of an asset when prices are low and less when prices are high. You effectively average the cost. 

For example, in June 2026, the average Bitcoin price was around €51,000. So, investors had an opportunity to get approximately 0.00097 BTC every time they made an installment. In September, the asset price went up to around €73,000. The fraction the investors got if they purchased Bitcoin was 0.00067 BTC, which is lower than before.

Since the investor first bought cryptocurrency cheaper and then at a higher price, the average cost per unit of BTC averaged down over time. Plus, the DCA removes emotional decision-making, the need to manage trades, and the stress typical for market timing.

What Changes If You Buy a Fixed 0.001 BTC Every Time?

Now let’s examine the opposite mechanics. With the second strategy, an investor commits to buying a strict quantity of cryptocurrency. Every purchase adds exactly 0.001 BTC to the portfolio. What changes is the sum of money an investor contributes, as it is directly dependent on fluctuations in quotes.

The target is the asset quantity, so you will have to accept that checking prices on the actual day of purchase might be unpleasant. When the digital asset price is low or goes down, you will spend less money. When the price rises, you’ll have to spend more euros.

For example, when the BTC cost on average €51,000 in June and July 2026, an investor needed €51 to get a fixed 0.001. In September, they already required €73 to acquire the same crypto portion. That’s before fees.

BTC accumulation becomes predictable while cash requirements are variable. The main drawback is that sometimes you will have to invest significantly more money than expected due to the wide price swings typical of crypto coins.

Is Buying 0.001 BTC Every Month Still Dollar-Cost Averaging?

No. Although this is a form of periodic investing, it lacks the core mathematical mechanism that gives the DCA method its name and provides its benefits. According to Investor.gov, dollar-cost averaging implies investing cash in equal portions at regular intervals. By doing so, an investor manages risk thanks to a consistent pattern of adding new money over a long time. Mathematically, this skews your average purchase price downward.

If an investor buys a fixed amount of Bitcoin every month, they lose the discount advantage of the DCA. They cannot control the sum of euros they spend, as it’s dependent on whether Bitcoin is cheap or expensive. The average cost per coin becomes the simple arithmetic average of the market prices. And this is fine, because the strategy is goal-oriented.

What Happens to Both Strategies When Bitcoin Rises or Falls?

The main distinguishing features of cryptocurrencies as an investment product are their high volatility, sensitivity to news, sudden surges, and sharp corrections. Therefore, you shouldn’t expect the same level of stability as with savings accounts or conservative assets. That’s why you need to understand what will happen to your money if market conditions and investor sentiment change dramatically, causing the crypto price to skyrocket or plummet.

• With the first strategy, when BTC is cheaper, €50 buys more of an asset, and when BTC is rising in value, the same €50 buys less.
• With the second one, buying a fixed 0.001 BTC requires fewer euros when the coin price falls, and the same fixed-BTC purchase becomes more expensive when it rises.

Which Strategy Is More Predictable?

The logic is as follows: fixed fiat = variable BTC; fixed BTC = variable fiat. The level of predictability of a strategy depends on what you actually want to predict. 

If you need a stable and recurring cash commitment to stay calm and disciplined, for example, if you set a fixed amount from your salary every month, then the DCA is a suitable approach for you. It will be easier to distribute your monthly investment budget between assets. But you don’t know how much Bitcoin you’ll end up receiving.

If you prioritize reaching a specific target, for example, you would like to have 0.024 Bitcoin in two years, then select the fixed 0.001 BTC strategy. The trade-off is accepting whatever budget fluctuations are necessary to get there. There won’t be an option to predict how much cash you will spend over the next two years.

How Do Fees and Minimum Orders Affect Regular Purchases?

The strategies described above share another common feature that stems from the regularity of investments. Since you’re not investing a lump sum all at once but making small purchases, you’ll consistently pay transaction fees, no matter which strategy you choose. You may also be affected by platform restrictions on minimum purchase amounts, if any, as well as taxes or fluctuations in the national currency exchange rate. 

After all the expenses are deducted, your €50 order won’t result in €50 worth of BTC being added to the portfolio. And with a 0.001 BTC order, you won’t pay exactly €51, even though the crypto was traded at €51,000. Fees increase the amount of fiat required.

Practical Calculation: €50 vs. 0.001 BTC Over Six Months

Using the historical month-end closing prices for the BTC-EUR trading pair for the six months up to September 2026, we can perform a calculation to see how the two strategies played out.

Does Either Approach Guarantee a Better Investment Outcome?

No. When investing a fixed amount in fiat currency, the average purchase price may be lower under some price scenarios and higher under others. The exact same situation applies when investing a fixed number of coins.

When Can a Fixed Amount or Fixed Quantity Become Impractical?

Both approaches have limitations. A fixed euro contribution can become very small relative to fees or the crypto equivalent. With a fixed BTC target, a quantity that initially seems affordable may later become harder to maintain. What’s more, neither method solves the broader question of whether BTC is suitable for the investor.

The difference lies in what determines your fiat installment and the pace at which you accumulate assets. This could be the extreme volatility of crypto or your preferences. A fixed-cash-amount strategy limits your financial risk by protecting you from price spikes. It helps you take advantage of market corrections. Conversely, a fixed-asset-amount option shifts all market risk onto you but guarantees a simple path to a specific crypto balance.

Disclaimer: The content provided in this article is for educational and informational purposes only and should not be considered financial or investment advice. Interacting with blockchain, crypto assets, and Web3 applications involves risks, including the potential loss of funds. Venga encourages readers to conduct thorough research and understand the risks before engaging with any crypto assets or blockchain technologies. For more details, please refer to our terms of service.

It's important to keep in mind that the same investment can be reasonable for one goal and unsuitable for another because the target amount, deadline, liquidity need and ability to absorb a loss are different for different goals. This is similar to how the same type of frosting can be suitable for one type of cake but not suitable for another type of cake. For example red velvet frosting is suitable for red velvet cake but maybe not for blueberry flavored cake. Keep in mind that this article explains a decision framework, not a model portfolio.

Start With the Goal, Amount and Date

To turn a broad wish into a real investment goal, you must build a clear framework using a Goal, Amount, and Date.

A broad wish like "I want to save for a house" has no plan. You transform it by defining four specific pieces:

• Target Amount: The exact sum you need (e.g., $60,000 for a down payment).
• Target Date: The month and year you need the money (e.g., December 2031).
• Current Savings: What you already have saved today (e.g., $10,000).
• Planned Contributions: The amount you will save regularly (e.g., $600 each month).
• The Result: "I will save $60,000 for a house down payment by December 2031 by starting with $10,000 and adding $600 every month."

Without a target date, you cannot define your time horizon (how long you will hold an investment). A goal with no deadline fails for three reasons:

• Wrong Investments: You cannot choose between safe options (like savings accounts for short timelines) and growth options (like stocks for long timelines).
• No Math: You cannot calculate how much money you need to save each month.
• No Urgency: You lose accountability and will likely skip saving.

Time Horizon, Risk Tolerance and Risk Capacity

Risk tolerance is your emotional comfort with market swings, while risk capacity is your actual financial ability to absorb a loss. A long horizon may provide more recovery time but does not make a risky asset safe. For example, having 30 years until retirement gives you time to recover if you lose money, but it does not remove the risk. A risky investment is still risky.

Before Investing for a Goal 

Before investing, secure your foundation so you never have to sell assets at a loss during an emergency.

• Emergency Savings: Keep 3 to 6 months of living expenses in a separate, safe account.
• High-Cost Debt: Pay off credit cards or high-interest loans first.
• Foreseeable Expenses: Set aside cash for any planned costs coming up in the next 2 to 3 years.
• Access to Cash: Ensure your cash is liquid and free of withdrawal penalties.

Spain and EU Rules

Asset Protection: The Spanish Fondo de Garantía de Depósitos (FGD) protects bank deposits up to €100,000 per person, per bank. A similar €100,000 limit applies across the EU. Spain's FOGAIN offers the same €100,000 coverage for investment accounts.

Tax Advantage: Spanish residents can transfer money between local investment funds (Fondos de Inversión) without triggering capital gains tax. You only pay tax when you cash out.

How Strategy Changes by Goal

Different goals call for different strategies, and that means different mixes of assets. Below is a quick look at how allocations might shift depending on what you're saving for. Keep in mind the specific assets listed are just examples to illustrate the idea, not a recommendation for what everyone should hold. Your right mix depends on your own timeline, risk tolerance, and situation.

Buying a Home in the Next Few Years

If you're buying in the next few years, the main risk isn't missing out on growth, it's having less money than you expected right when you need it. A market drop the month before your deposit is due can hurt a lot more than a market drop you have years to recover from.

If your date is flexible: you can afford to hold a bit more risk, maybe a modest equity allocation early on, then shift into cash and short-term bonds as the purchase gets closer. If the market dips, you can simply wait.

If your date is fixed (like a signed contract or a set closing date): that flexibility disappears. In this case, most of the money should already be sitting in cash or very short-term, low-volatility instruments well before the deadline, since you won't have time to recover from a downturn.

Building General Savings Without a Fixed Date

Without a fixed date, you can trade some certainty for growth, since there's no deadline forcing you to sell at a bad time. However, "savings" is really two buckets. Emergency money needs to be accessible instantly, so it stays in cash or a high-yield account, not invested. Everything else can behave more like long-term investing, since you have time to ride out dips. The less certain you are when you'll need it, the more risk that money can handle.

A Long-Term Goal

When you are investing for a long-term goal, you are building an investment strategy to help your money grow over many years while managing the bumpy ride along the way.

• Diversification: Don't put all your eggs in one basket. Spreading your money across different investments—like mix of stocks and bonds—helps ensure you aren't wiped out if one single company or sector fails.
• Contributions: Making regular, steady additions to your account builds momentum. It keeps you moving forward, regardless of whether the market is up or down at any given moment.
• Rebalancing: Over time, some investments grow faster than others, which changes your original plan. Periodically resetting your portfolio back to your target mix keeps your risk level right where you want it.
• Short-Term Volatility: Be prepared for a wild ride. To chase bigger long-term growth, you often have to accept higher short-term ups and downs. Market drops can be stressful, and it is important to remember that prices can swing wildly and unpredictably.

Planning for the long term isn't about predicting the future. It is about setting up a balanced system that you can stick with through all kinds of market changes.

Several Goals at Once

The bucket approach means dividing your money into separate "buckets" based on when you need it and how much risk you want to take. Instead of putting all your money into one big portfolio, you treat each bucket like its own independent mini-portfolio.

It's like organizing your clothes. Instead of throwing every shirt, pants, and pair of socks into one giant pile, you use separate dresser drawers for different types of outfits.

• Separate Dates: You group your money by when you will need to spend it.
• Separate Amounts: You calculate exactly how much money belongs in each group.
• Separate Risk Limits: You choose different investment styles for each bucket. Money you need tomorrow stays in cash. Money you won't touch for ten years goes into riskier investments like stocks and/or crypto.

While this system keeps you organized, it creates two major challenges:

• Extra Complexity: Managing three or four separate buckets takes a lot of work. You have to constantly move money between buckets as time passes and your goals change.
• Duplicate Exposures: You might accidentally buy the same exact investment in two different buckets. For example, if Bucket 2 and Bucket 3 both own the same tech company stock, you are taking on way more risk in that one company than you realize.

Goal Comparison Table

Worked Example: From Target Amount to Monthly Contribution

Say you're saving €30,000 for a deposit in Spain, and you already have €12,000 put away, with 24 months to go.

• Gap: €30,000 − €12,000 = €18,000
• Time left: 24 months
• Required monthly contribution: €18,000 ÷ 24 = €750/month, assuming zero growth

That €750 is the number you can actually count on, it just comes from saving. If you assume a 4% return and lower your monthly contribution because of it, you're now depending on the market cooperating with your exact timeline. Returns are an average over time, not a guarantee for any specific two-year window. Build your plan on the contribution that gets you there with no growth, and let any actual returns be a bonus that gets you there early, not a number you're relying on to make your investment goals work at all.

Where Crypto May or May Not Fit

Crypto is a volatile allocation whose suitability depends on your investment goals and capacity for loss. Money required on a fixed near-term date may be particularly exposed to timing risk.

Even with new European laws in place, official European Supervisory Authorities (ESAs)—including the European Securities and Markets Authority (ESMA)—continue to issue strict warnings regarding digital assets. Regulators warn that many crypto-assets are highly speculative and retail consumers face the very real possibility of losing 100% of their invested money.

Reviewing the Strategy as the Goal Gets Closer

When you set a big financial goal, you can't just set it and forget it. As you get closer to your target date, you need to check in on your plan.

Think of your investment strategy like a GPS. If you change where you are going, the GPS needs to recalculate.

You should sit down and look at your investment strategy whenever major changes happen.

• The Timeline Changes: Your goal date moves closer or further away.
• Income Changes: You get a big raise, or you lose a job.
• Target Changes: You decide you need more or less money than you first thought.
• Major Loss: A market crash or an emergency wipes out some of your savings.

When these triggers happen, or as your deadline approaches, you will likely use two main tools:

• De-risking: This means moving your money into safer places.
• Rebalancing: This means resetting your investments back to your original plan. If your stocks grew really fast, they might now make up too much of your total money. You sell some stocks and buy other things to bring your plan back into balance.

Changing your strategy isn't always free. You need to watch for two things:

• Transaction Fees: Your bank or investment app might charge you a fee every time you buy or sell.
• Taxes: When you sell investments for a profit, the government often takes a cut (capital gains taxes).

Conclusion: A Strategy Is a Route to a Specific Goal

An investment strategy serves as a practical route to a specific goal by integrating the target amount, date, liquidity needs, and acceptable loss into a cohesive plan. Before continuing, you should verify all details within official product documents and consult with a qualified professional regarding your personal tax situation.

Disclaimer: The content provided in this article is for educational and informational purposes only and should not be considered financial or investment advice. Interacting with blockchain, crypto assets, and Web3 applications involves risks, including the potential loss of funds. Venga encourages readers to conduct thorough research and understand the risks before engaging with any crypto assets or blockchain technologies. For more details, please refer to our terms of service.