The Protocol: Self-spreading Malware Found in Privacy Crypto Dero

May 28, 2025

Exploring the tech behind crypto

one block at a time

Was this newsletter forwarded to you? Sign up here.

Welcome to The Protocol, CoinDesk’s weekly wrap-up of the most important stories in cryptocurrency tech development. I’m Margaux Nijkerk, the Ethereum protocol reporter on CoinDesk’s Tech team.

In this issue:

The Solana Network Is Now Live on MetaMask
Privacy Crypto Dero Targeted With New Self-Spreading Malware
FIFA Teams Up With Avalanche to Build Its Own Blockchain, Expanding Web3 Ambition
Square Pilots Real-Time Bitcoin Payments in Vegas, Plans Full Availability to Customers in 2026

Network News

SOLANA NOW ON METAMASK: MetaMask announced on Tuesday that its Solana integration was live, meaning that users can now transact on the second-largest smart-contract platform and interact with Solana-based applications through the wallet. The integration is currently only on desktop, but is slated to launch on the MetaMask mobile app in the coming weeks, the company said. MetaMask is the Ethereum network’s most popular browser wallet, with over 100 million annual users. — Tom Carreras Read more.

SELF-SPREADING MALWARE FOUND IN PRIVACY CRYPTO DERO: A newly discovered Linux malware campaign is compromising unsecured Docker infrastructure worldwide, turning exposed servers into part of a decentralized cryptojacking network that mines the privacy coin Dero. According to a report by cybersecurity firm Kaspersky, the attack begins by exploiting publicly exposed Docker APIs. In software terms, a docker is a set of applications or platform tools that delivers software in small packages called containers. Once access is gained, the malware spawns malicious containers. It infects already-running ones, siphoning system resources to mine Dero and scan for additional targets without requiring a central command server. As of early May, over 520 Docker APIs were publicly exposed over port 2375 worldwide — each one a potential target. — Shaurya Malwa Read more.

FIFA TAPS AVALANCHE FOR OWN BLOCKCHAIN: FIFA, football’s global governing body, plans to use Avalanche’s network to power its own dedicated layer-1 blockchain. The FIFA Blockchain is an Avalanche L1, a customizable blockchain that uses Avalanche’s technology (previously known as a subnet). The news comes as the Avalanche network recently went through its major Avalanche9000 upgrade, aimed at attracting new developers and encouraging them to create customized L1s. Thursday’s announcement is not FIFA’s first foray into the world of blockchain and crypto. In 2022, the football body released a non-fungible token (NFT) collection on the Algorand blockchain ahead of the Qatar World Cup. — Margaux Nijkerk Read more.

SQUARE PILOTS BITCOIN PAYMENTS: Jack Dorsey’s Square took bitcoin payments a step further at the Bitcoin 2025 conference in Las Vegas this week. For three days, the company is piloting a program where attendees can make purchases with their bitcoin by scanning a barcode. Payments are then settled in near real-time via the Lighting Network while Square handles real-time exchange rate calculations and confirmation notifications, according to a press release. Square hopes to make the feature available to a broader audience later this year and to all customers by 2026, pending regulatory approval. — Helene Braun Read more.

In Other News

Bitcoin’s upward trend continued to show signs of weakness early Wednesday, even as Wall Street tech stocks surged overnight in anticipation of upbeat earnings from AI giant Nvidia (NVDA). The leading cryptocurrency by market value traded near $108,900 at press time, teasing a downside break of a trendline characterizing the uptrend from early April lows, according to data source Coingecko. Bullish trendlines indicate areas of strong demand, thus a move below one is generally seen as a sign of a potential reversal and a possible start of a downward move. — Omkar Godbole Read more.
The U.S. Securities and Exchange Commission (SEC) has formally initiated a review of the WisdomTree XRP Trust, a proposed spot exchange-traded fund (ETF) that would provide investors with exposure to XRP. Filed by the Cboe BZX Exchange, the application marks the first formal SEC review of a U.S.-based spot XRP ETF. If approved, it would be the first spot XRP ETF in the U.S. — a milestone that could open the door for similar products across other crypto assets. — Shaurya Malwa Read more.

Regulatory and Policy

The U.S. Senate appears closer to passing its landmark stablecoin bill, the GENIUS Act, following a battle that Senator Cynthia Lummis (R-Wyo.), the bill’s main legislative champion, called incredibly hard-fought. “It has been extremely difficult,” Lummis said during a fireside chat with Coinbase’s Chief Legal Officer Paul Grewal at Bitcoin 2025 in Las Vegas on Tuesday. “I had no idea how hard this was going to be.” Last week, the Senate voted to advance the bill, easily clearing the 60-vote threshold required to kick the bill to its last discussion phase before the final vote to pass it out of the body entirely. An earlier attempt failed on a bipartisan basis after Senate Democrats, led by long-time crypto sceptic Elizabeth Warren (D-Mass.), as well as several Republicans, including Missouri’s Josh Hawley and Kentucky’s Rand Paul, voted against cloture. — Cheyenne Ligon Read more.
A man suspected of helping kidnap and torture an Italian cryptocurrency investor in a Manhattan townhouse has surrendered to New York City police. William Duplessie turned himself in Tuesday after what officials described as days of negotiations with authorities, the New York Times reports. He is the third suspect in an alleged plot to extract the keys to a bitcoin wallet belonging to Michael Valentino Teofrasto Carturan, a crypto fund associate who said he was held captive and abused for nearly three weeks. — Francisco Rodrigues Read more.