Crypto exploit losses tied to TVL in 2025 have exceeded $2.53 billion, with social engineering responsible for 55.3% ($1.39 billion), according to Sentora. Chainalysis estimates $2.7–$3.4 billion was stolen across all theft categories this year, including $2.02 billion linked to DPRK-affiliated groups and an estimated $1.4 billion taken from Bybit.

On December 22, 2025, 18 US House lawmakers pressed the IRS to revisit staking reward taxation, while the Federal Reserve sought public comment on a new limited-use "payment account" with a 45-day window. On December 23, 2025, the SEC charged alleged fake crypto platforms and AI clubs over a $14 million retail fraud, and Arizona lawmakers advanced crypto tax exemption bills.

On December 26, Trust Wallet reported that about $7 million was affected by a security incident tied specifically to its browser extension version 2.68 and pledged to fully reimburse impacted users. The company urged those using the vulnerable Chrome extension release to disable it and upgrade to version 2.69, while stressing that mobile users and other extension versions were not impacted.

Adopted by the Council of the EU in October 2023, DAC8 will require crypto platforms to begin reporting user and transaction data to national tax authorities on 1 January 2026, with full compliance due by 1 July 2026. The framework covers EU CASPs and non‑EU providers serving EU residents, excludes CBDCs and certain e‑money tokens, and enables automatic data sharing among member states.

On 26 December 2025, Aave token holders voted down a proposal to move the protocol's brand assets, such as domains and social media accounts, under direct DAO control. The vote drew a high abstention rate and renewed concerns over governance incentives, token value capture for AAVE holders, and the influence of large stakeholders in Aave's decision-making structure.

Japan's ruling coalition released its 2026 tax reform blueprint on December 19, outlining how crypto assets could be treated within the national tax system. According to CoinPost, the plan considers separate taxation for gains from spot trading, derivatives, and crypto ETFs, and proposes loss carryforward for up to three years. Staking, lending rewards, and NFTs are not explicitly covered.

Crypto.com Arena outlines a cashless experience with digital-only tickets and strict entry protocols for December 2025. Bag policy allows only small clutches or wallets under roughly 5 x 9 x 1 inches, with medical and parental bags X‑ray screened. Fans are advised to arrive about an hour early for Lakers games and holiday concerts.

On Christmas Day, a coordinated exploit against Trust Wallet's browser extension version 2.68 led to around $7 million in user losses, with the company urging an urgent upgrade to version 2.89. Security researchers said the backdoor was prepared from early December, while Binance co-founder Changpeng Zhao pledged that affected users would be fully compensated. The incident has intensified debate over wallet security and potential insider involvement across the crypto industry.