Attackers have exploited a vulnerability tied to Trust Wallet's Chrome browser extension, affecting hundreds of users and draining about $6.77 million to $7 million in assets. Trust Wallet has urged users of Browser Extension 2.68 to upgrade to 2.69 and pledged to fully reimburse all impacted accounts, while on-chain analysts track roughly $5.5 million already routed through swap services and exchanges.

Wintermute founder and CEO Evgeny Gaevoy said the firm will vote against Aave's token alignment proposal, arguing that it lacks clear structure, governance, and value capture. The move adds to mounting resistance inside the AAVE DAO, where a Snapshot vote set to close on December 26 currently shows most participants rejecting or abstaining on the plan, which seeks to shift control of brand assets to tokenholders.

Crypto exploit losses tied to TVL in 2025 have exceeded $2.53 billion, with social engineering responsible for 55.3% ($1.39 billion), according to Sentora. Chainalysis estimates $2.7–$3.4 billion was stolen across all theft categories this year, including $2.02 billion linked to DPRK-affiliated groups and an estimated $1.4 billion taken from Bybit.

On December 22, 2025, 18 US House lawmakers pressed the IRS to revisit staking reward taxation, while the Federal Reserve sought public comment on a new limited-use "payment account" with a 45-day window. On December 23, 2025, the SEC charged alleged fake crypto platforms and AI clubs over a $14 million retail fraud, and Arizona lawmakers advanced crypto tax exemption bills.

On December 26, Trust Wallet reported that about $7 million was affected by a security incident tied specifically to its browser extension version 2.68 and pledged to fully reimburse impacted users. The company urged those using the vulnerable Chrome extension release to disable it and upgrade to version 2.69, while stressing that mobile users and other extension versions were not impacted.

Adopted by the Council of the EU in October 2023, DAC8 will require crypto platforms to begin reporting user and transaction data to national tax authorities on 1 January 2026, with full compliance due by 1 July 2026. The framework covers EU CASPs and non‑EU providers serving EU residents, excludes CBDCs and certain e‑money tokens, and enables automatic data sharing among member states.

On 26 December 2025, Aave token holders voted down a proposal to move the protocol's brand assets, such as domains and social media accounts, under direct DAO control. The vote drew a high abstention rate and renewed concerns over governance incentives, token value capture for AAVE holders, and the influence of large stakeholders in Aave's decision-making structure.

Japan's ruling coalition released its 2026 tax reform blueprint on December 19, outlining how crypto assets could be treated within the national tax system. According to CoinPost, the plan considers separate taxation for gains from spot trading, derivatives, and crypto ETFs, and proposes loss carryforward for up to three years. Staking, lending rewards, and NFTs are not explicitly covered.