NEWS
DAEMON Tools Installer Hack Plants Hidden Backdoor on PCs in 100+ Countries
Official DAEMON Tools installers pulled directly from the company’s own website carried a hidden backdoor for nearly a month before anyone caught it. Kaspersky’s Global Research and Analysis Team disclosed on May 5, 2026 that trojanized versions 12.5.0.2421 through 12.5.0.2434 reached users in more than 100 countries, and the supply chain attack was still live at the time of disclosure.
The infected files were signed with a valid certificate belonging to AVB Disc Soft, the developer of the disc-imaging utility. That signature let the malware sail past Windows SmartScreen, antivirus reputation checks, and the basic trust assumption every user makes when they download software from a product page they’ve used for years.
Most of the thousands of compromised machines belonged to home users. About a dozen received a second-stage payload built for espionage, including a previously undocumented remote access tool the researchers call QUIC RAT.
Inside The Tampered Installer
The compromise sits inside three executables that ship with every standard install of the Windows tool. Securelist’s technical breakdown of the trojanized binaries identifies them as DTHelper.exe, DiscSoftBusServiceLite.exe, and DTShellHlp.exe. All three run automatically at startup, which is what gives the implant persistence without user interaction.
Kaspersky logged eight infected installer SHA-1 hashes, one per published patch in the affected band. Each carried AVB Disc Soft’s real digital signature, which is the detail that makes this campaign different from the cracked-installer junk circulating on torrent sites.
Malicious payload activity only kicks in after the legitimate setup completes. Users see the familiar progress bar, the licence prompt, the desktop shortcut. Behind that, three system processes start phoning out to a server that does not belong to AVB Disc Soft.
Three trojanized binaries have been publicly confirmed:
- DTHelper.exe: helper service that loads on user logon.
- DiscSoftBusServiceLite.exe: background service tied to the virtual disc bus driver.
- DTShellHlp.exe: shell extension that hooks Windows Explorer right-click menus.

How The Hidden Backdoor Phones Home
Once the trojanized service starts, it reaches out to env-check.daemontools[.]cc, a typosquat of the real daemon-tools[.]cc domain. The lookalike was registered on March 27, 2026, twelve days before the malicious installers went live. That gap is the clearest planning signal in the whole campaign.
The first stage delivers a .NET tool called envchk.exe that profiles the machine. It hands back the MAC address, hostname, DNS suffix, list of running processes, installed software, and system locale to a hardcoded server at 38.180.107[.]76. From there a small backdoor loader, cdg.exe, decrypts an RC4-encrypted payload (cdg.tmp) and runs it directly in memory.
Mapped end to end, the chain looks like this:
- Initial beacon: GET request to env-check.daemontools[.]cc with hostname appended.
- Profiling: envchk.exe collects system data through a .NET assembly carrying Chinese-language strings.
- Loader stage: cdg.exe maps cdg.tmp into memory using shellcode injection.
- Command execution: PowerShell pulled through cmd.exe, often hiding inside legitimate processes like notepad.exe and conhost.exe.
Surgical Targeting Hidden Inside A Mass Campaign
The numbers tell the real story of this attack. Kaspersky’s telemetry counted thousands of installation attempts across more than 100 territories. Roughly 10 percent landed inside organizations. Around 90 percent hit home machines.
Then the funnel narrows hard. Only about a dozen of those compromised systems received any second-stage payload at all. The rest sat profiled and untouched. That selection ratio is what separates this from a smash-and-grab cybercrime operation. The crew was fishing for specific victims and ignoring the catch they didn’t want.
The follow-on victims clustered tightly:
- Russia, Belarus, and Thailand: hosted the dozen machines that received advanced payloads.
- Russia, Brazil, Türkiye, Spain, Germany, France, Italy, and China: dominated the bulk infection wave.
- Retail, government, scientific, and manufacturing sectors: made up the targeted second-stage hits.
Look past the geographic spread and the picture turns colder. Thousands of innocent home installs served as cover noise for a campaign whose real target list could fit on a Post-it note.
The QUIC RAT That Only Hit One Russian School
Every other payload in the chain looks like a recon kit. The most sophisticated tool reached a single victim: an educational institution in Russia. Kaspersky tracks it as QUIC RAT.
It’s a C++ implant, statically linked against the WolfSSL library, with control flow flattening obfuscation that makes static analysis painful. The interesting part is its transport layer. QUIC RAT can talk to its operators over HTTP, TCP, UDP, WSS, DNS, QUIC, or HTTP/3. That kind of protocol versatility is unusual in a tool researchers had not catalogued before this campaign.
Process injection targets are notepad.exe and conhost.exe, two of the quietest binaries on a typical Windows desktop. A user who notices a Notepad window flicker open and shut would not assume the operating system’s text editor is running an espionage payload.
“A compromise of this nature bypasses traditional perimeter defenses because users implicitly trust digitally signed software downloaded directly from an official vendor,” said Georgy Kucherin, senior security researcher at Kaspersky GReAT.
Why The Chinese-Speaking Attribution Stays Soft
Researchers flagged Chinese-language strings inside the implants and consistent hardcoded paths that read more naturally in Mandarin than in English. That is the basis for the attribution in every public writeup of the campaign.
It’s not a confident attribution. Language artifacts inside malware are easy to plant deliberately, and Kaspersky has not tied the operation to any tracked Chinese-speaking group such as APT41 or Mustang Panda. GReAT frames the link as suggestive, not concluded. That distinction matters, because Western coverage often collapses “Chinese-speaking artifacts” into “China did it,” and the gap between those two claims is exactly the space where false flag operations live.
Disc Soft’s Reply And What Users Should Do Right Now
AVB Disc Soft acknowledged the report on May 5, 2026 but stopped short of confirming any of the technical findings. “Our team is treating this matter with the highest priority and is actively working to assess and address the issue,” the company said in a statement. “At this stage, we are not in a position to confirm specific details referenced in the report.”
As of publication, the developer has not announced a clean replacement build, has not published a list of confirmed safe hashes, and has not disclosed whether its signing certificate has been revoked. The DAEMON Tools downloads portal at daemon-tools.cc still serves the same product line, which puts the burden of verification on the user.
Independent verification has come from researchers, not the vendor. Kaspersky’s user-facing advisory recommends a manual sweep of any system that installed DAEMON Tools after April 8, 2026.
The recommended actions, in order:
- Audit the install date: anything installed or updated on or after April 8, 2026 is suspect.
- Isolate the host: pull it off corporate networks before further analysis.
- Hunt for indicators: look for outbound traffic to env-check.daemontools[.]cc and 38.180.107[.]76.
- Uninstall: remove the application and the three named binaries; assume residual implants until forensics says otherwise.
- Rotate credentials: anything entered or cached on the affected host should be considered exposed.
Home users with no specific indication of compromise should still uninstall and wait for the developer to publish a known-clean build. There is currently no way to confirm a downloaded installer is unaffected without manually checking its hash against Kaspersky’s published indicator list.
A Pattern Building Through 2026
DAEMON Tools is the fourth confirmed software supply chain compromise of the year, after eScan in January, Notepad++ in February, and CPU-Z in April. All four cases share the same playbook: trojanize a trusted desktop utility at the source, ride the developer’s own distribution channel, sit on the access for weeks.
Detection delay on this one ran about 30 days. Kaspersky’s analysts compared that gap to the 3CX attack of 2023, which also stayed hidden for roughly a month. Both fit the threat pattern documented in the CISA guide on defending against software supply chain attacks, classified by MITRE ATT&CK technique T1195.002 for compromised software supply chains.
Frequently Asked Questions
Should I Uninstall DAEMON Tools Right Now?
Yes, if you installed or updated it on or after April 8, 2026. Open Settings, then Apps, find DAEMON Tools or DAEMON Tools Lite, and remove it. After removal, restart and run a full scan with current antivirus definitions. The Kaspersky cleanup advisory for affected DAEMON Tools users walks through what to look for. Wait for AVB Disc Soft to publish a verified clean build with a fresh signing certificate before reinstalling.
Will My Antivirus Catch The Backdoor On Its Own?
Probably not without an updated signature pull. The malicious binaries carried valid AVB Disc Soft signatures, which trips most reputation-based defenses into trusting them. Make sure your security tool ran a definition update after May 5, 2026, the day Kaspersky published the indicators of compromise. Kaspersky, Microsoft Defender, ESET, and Bitdefender have rolled detection for the eight known infected installer hashes since then.
How Can I Tell If The Installer I Downloaded Is Clean?
Check the SHA-1 hash of your installer file against the eight known-bad hashes published in Kaspersky’s writeup. In Windows, run “certutil -hashfile [filename] SHA1” in Command Prompt. If your hash matches any in the published list, you have a confirmed-bad copy and should isolate the machine. If it does not match, that is reassuring but not definitive while the campaign remains active.
Were Mac Or Linux Users Affected?
No, based on currently disclosed indicators. The malicious binaries are Windows-only PE executables, and Kaspersky’s telemetry only flagged Windows installations. AVB Disc Soft has not yet stated whether its macOS product line shares any code or signing infrastructure with the compromised Windows builds. Users on other platforms should still treat any post-April 8 download with caution until the vendor publishes a complete scope statement.
Does Removing DAEMON Tools Clean The Malware?
Not always. The implant can drop additional payloads outside the application folder, including in-memory code injected into notepad.exe and conhost.exe. After uninstalling, run a boot-time antivirus scan and check scheduled tasks, run-on-startup registry keys, and outbound connections to 38.180.107[.]76. Targeted victims, particularly inside organizations, may need a full forensic image rather than a standard cleanup pass.
The DAEMON Tools breach is small in raw victim count and large in implication. A widely trusted utility, downloaded from a brand-name domain, with an authentic developer signature, was a malware delivery channel for almost a month. The next time a similar headline lands, the right reaction is not surprise.
Anyone who hit the download button between April 8 and May 5 should treat that machine as suspect until AVB Disc Soft publishes a known-clean replacement with a fresh certificate. The dozen targeted victims will be doing exactly that, and probably more.
GAMING
Asha Sharma Reshuffles Xbox Leadership In Race To Project Helix
Xbox CEO Asha Sharma reshuffled her senior team on Tuesday, importing four executives from Microsoft’s CoreAI division and elevating 20-year company veteran Jason Ronald to run Project Helix, the next-generation Xbox console. The May 5, 2026 memo, sent to Xbox staff and seen by IGN, said it had become “too hard to ship impact quickly” and that the unit “lacks the capability we need in some key areas.” Hardware revenue at Microsoft’s gaming segment fell 33% in the March quarter, the second straight quarter of 30%-plus declines, and Sharma’s runway to a Helix dev kit launch in 2027 is short.
The reshuffle pulls together CoreAI lieutenants who reported to Sharma before her February move to gaming and shifts veteran hardware leader Roanne Sones into an advisor role later this year. It also ends Kevin Gammill’s 24-year run at Microsoft.
Who’s In, Who’s Out At The New Xbox
Sharma’s note names six new appointees and two notable exits. Most picks come from people she worked with at CoreAI, the engineering group inside Microsoft that builds the Copilot stack, GitHub Copilot, and the Azure AI Foundry tools she previously oversaw as president of CoreAI Product before Microsoft’s February announcement of her appointment as gaming CEO. The full slate breaks out like this:
- Jason Ronald moves up to lead Project Helix and the wider Xbox platform after more than two decades on Xbox hardware.
- Jared Palmer joins from CoreAI to run platform-level developer tooling and content infrastructure; he previously served as SVP at GitHub and VP at Vercel.
- Tim Allen takes over experience design, fusing product design, engineering, research, and creative under one fan-first mandate.
- Jonathan McKay becomes Xbox’s head of growth, joining from CoreAI after stints at Meta and OpenAI.
- Evan Chaki runs a new engineering group focused on cutting repetitive work and simplifying internal development.
- David Schloss moves from Instacart, where he worked alongside Sharma, to lead Xbox subscriptions and cloud.
- Roanne Sones, the corporate vice president overseeing Xbox devices, takes a planned leave of absence later this year and returns as an Xbox advisor.
- Kevin Gammill, a 24-year Microsoft veteran whose career spanned Xbox user experience and game dev platforms, exits the company.

The CoreAI Imports
Four of the six new lieutenants come straight from CoreAI. Their reporting relationships at Sharma’s old org give the move a clear shape. She is importing the team that ran her previous group’s product velocity engine.
Palmer’s brief, “investing in the systems that make it easy to build, submit and scale high-quality games,” reads as a developer-tools mandate transposed from CoreAI’s GitHub Copilot work into Xbox’s certification, publishing, and live-ops pipelines. Chaki’s remit, removing repetitive work and simplifying day-to-day development, fits the same pattern. Both reflect what CoreAI shipped fast and what Xbox has not.
The Promotions And Exits
Ronald’s elevation is the load-bearing internal pick. He has worked on Xbox hardware programs since the original Xbox One generation and now owns the most consequential roadmap in Microsoft Gaming.
Gammill’s departure quietly closes a long chapter. He spent 24 years at Microsoft across two stints, most of it on Xbox user experience, gaming partner programs, and developer publishing tools. Sones, who led the Xbox Series X|S devices group, will leave for a long-planned absence and rejoin later in an advisory capacity.
The Numbers Behind The Hurry
Xbox is bleeding revenue on the hardware side. Microsoft’s FY26 Q3 segment revenue results show gaming revenue down 7% year-over-year for the quarter ending March 31, 2026, content and services down 5%, and hardware down 33%. That marks the ninth consecutive quarter of hardware declines and the second straight quarter with a 30%-plus drop, after a 32% fall in the December quarter.
Total Xbox gaming revenue slid to roughly $5.34 billion from $5.72 billion the year prior, a $380 million gap inside a single quarter. The hardware line is the most exposed, given Xbox Series X|S consoles are deep into the back end of their generation.
Sharma acknowledged the shortfall in a public note last week. “Player and revenue growth has not yet met our ambition,” she wrote, adding that Xbox still has “work to do to earn every player today and into the future.”
That admission sits awkwardly next to a Microsoft Cloud quarter that delivered $54 billion in revenue, up 29%, and an AI business now running at a $37 billion annual revenue rate. Inside Redmond, gaming is the slow lane in a company whose other lanes are sprinting.
A CoreAI Pipeline Now Plugs Straight Into Xbox
The overlap between Sharma’s old org and her new team has set off alarms with industry watchers. Joost van Dreunen, founder of analytics firm Aldora and a lecturer at NYU Stern, told the trade press the move signals a shift in priority order at Microsoft Gaming.
“Gaming might become subordinate to Microsoft’s horizontal AI ambitions rather than treated as a category with its own logic and culture.”
Sharma has tried to head off that read. She has publicly pledged no “soulless AI slop” on Xbox and framed the new appointments internally as bringing in the best talent rather than reorienting Xbox’s AI policy. IGN reported that the company’s prior stance on AI tooling and content remains unchanged.
There is also a tension inside Sharma’s own messaging. In an April 24 interview transcript with Sharma and chief content officer Matt Booty, she told independent journalist Stephen Totilo: “I want to make the right decision, not the fastest decision.” Two weeks later, her staff memo argues the opposite, that shipping speed is the bottleneck. The reshuffle is how she squares those two statements.
Project Helix Runs On A Tight Clock
Project Helix is the gun to Sharma’s head. The next-gen Xbox, previewed at GDC in March with detailed silicon specs, runs on a custom AMD SoC with RDNA 5 graphics, AMD FSR Next+ machine-learning upscaling, GPU Directed Work Graph Execution, and Deep Texture Compression. Microsoft has confirmed alpha hardware ships to developers in 2027.
From a typical 18-to-24 month dev kit window, a late 2027 or 2028 consumer launch is the only realistic read. That is the timeline Ronald inherits.
The headline feature is platform reach. Helix is being designed to play “your Xbox console and PC games,” a clear positioning shift toward Valve’s Steam Machine and Windows 11 handhelds rather than head-to-head against the PlayStation 6.
That requires new tooling, new certification flows, and a much deeper PC build pipeline. Most of that work falls to Palmer and Chaki, whose CoreAI backgrounds are precisely about developer infrastructure rather than triple-A game production. The fit is tighter than the headlines suggest.
If Helix slips, Sharma’s memo on velocity becomes an indictment of her first year. If it lands on time and runs well, the CoreAI imports will look prescient.
Game Pass Math Is The Other Squeeze
The hardware line is not the only number sliding. Xbox’s content and services revenue, which includes Game Pass, was down 5% year-over-year in the same March quarter. Microsoft’s April 21 Game Pass pricing update tried to widen the funnel by trading away day-one Call of Duty access in exchange for a sharp price drop.
- $22.99 per month: New Game Pass Ultimate price, down from $29.99 set last year.
- $13.99 per month: New PC Game Pass price, down from $16.49.
- About $300 million: Estimated Call of Duty console and PC sales Microsoft gave up in the prior year by including the franchise on Game Pass at launch, per internal accounting cited in the FTC trial record.
- Roughly 12 months: The expected delay future Call of Duty titles will see before reaching the subscription.
That concession was Sharma’s first hard pricing decision, and it hands cash flow back to the publisher side of the house. It also slows the perception that Xbox subsidies are propping up Activision Blizzard’s release calendar.
What The Memo Actually Asked For
The reshuffle lands a month after Sharma and Booty’s “We Are Xbox” mission statement, which retired the Microsoft Gaming brand and reset platform priorities to four areas: hardware, content, experience, and services. The document also acknowledged player frustration over higher prices, missing console features, and a thin PC presence.
The new appointments map almost one-to-one onto those four pillars. Schloss owns services. Allen owns experience. Palmer and Chaki own the platform plumbing under both content and hardware. Ronald sits across content and hardware via Helix.
The cultural ask in the memo is bigger than the org chart. Sharma wants less time spent inward, more time with players, and faster shipping cycles. Whether a CoreAI playbook can produce that inside the largest console publisher Microsoft has ever owned, after Activision Blizzard King added more than 30,000 employees to the unit in 2023, is the bet she has now placed in writing.
Sharma’s first ten weeks have already produced a brand reset, a Game Pass repricing, a public memo on culture, and a leadership rewrite. The next visible test is whatever Xbox shows of Project Helix later this year, with developers waiting and Microsoft’s quarterly earnings cadence ticking. The clock she described in May is the same clock everyone else can read.
CRYPTO
Republic Tokenizes Animoca Brands Equity on Solana for Retail Buyers
Republic, the global investment platform with $3 billion deployed across 2,500-plus companies, is moving Animoca Brands’ private equity onto the Solana blockchain, a tokenization push first unveiled on September 30, 2025 and still rolling out as of May 2026. Existing Animoca shareholders can already claim tokenized shares directly to their wallets through Republic, and a public waitlist for new buyers is open at republic.com/animoca. The deal lands while Animoca, the Hong Kong Web3 group with more than 600 portfolio investments, races toward a separate $1 billion Nasdaq listing through a reverse merger with Currenc Group targeted to close inside 2026.
Andrew Durgee, Co-CEO at Republic, called the structure “a precedent for how companies can structure their equity for the future” in Republic’s September 30, 2025 announcement on tokenizing Animoca equity. Pricing, the exact token standard, and the public trading start date have not yet been disclosed.
The setup is unusual. Animoca was kicked off the Australian Securities Exchange on March 9, 2020 after the ASX cited governance concerns and “involvement in cryptocurrency related activities.” Six years later, the company is using the same crypto rails it was once punished for to reach retail investors again, this time on Solana, this time with regulators watching.
How the Solana Token Actually Works
Solana hosts the mint. Republic handles distribution, identity checks, and secondary trading. The tokens represent economic exposure to Animoca’s equity rather than direct cap-table ownership, a design Republic has standardized through its Mirror Tokens program for private companies.
Existing shareholders need to register a whitelisted wallet before they can claim. New buyers join the waitlist and clear Republic’s eligibility checks, which typically split between Republic’s Regulation D explainer for accredited US investors and Regulation S for offshore participants. Republic has said the Animoca token “will comply with existing regulatory requirements” without naming a specific exemption for this offering.
The minimum buy-in for Republic’s public Mirror Token tier starts at roughly $50, with no accreditation required. That floor is what makes the offering meaningfully different from the over-the-counter secondary market where Animoca shares have traded since the ASX exit.
What’s confirmed so far:
- Tokens minted on Solana and distributed to whitelisted wallets
- Trading routed through Republic’s global marketplace once live
- Compliance anchored to existing US and offshore securities exemptions
- Existing shareholders eligible to claim tokenized representations of their holdings
What’s still blank:
- The exact SPL token standard or custom contract structure
- Public trading start date and any lockup or holding period
- Per-token pricing and any cap on retail allocation
- Whether the token survives, converts, or unwinds at the Nasdaq merger close

The $1 Billion Nasdaq Bid Running In Parallel
Animoca isn’t betting on tokens alone. On November 3, 2025, Currenc Group, a Singapore-based fintech trading on Nasdaq under ticker CURR, signed a non-binding term sheet for a reverse merger with Animoca Brands Corporation Limited. The combined entity targets a roughly $1 billion valuation, well below Animoca’s last private mark of $5.9 billion set in 2022.
Animoca shareholders would hold about 95% of the merged company under the headline terms in Animoca Brands’ November 2025 reverse merger announcement with Currenc Group. Existing Currenc holders would keep the remaining 5%. Closing requires regulatory sign-off in the US and Australia, audited financials, court authorization in Australia, and a shareholder vote on both sides.
The two tracks complement each other in a way most private companies can’t replicate. The Nasdaq listing buys institutional credibility and a real ticker. The Solana token opens fractional, 24/7 access to a global retail base that may never read a prospectus.
It also creates a regulatory question nobody has fully answered. If the Nasdaq deal closes on schedule, Animoca’s claim on its own balance sheet will exist in two parallel forms: registered common stock under SEC oversight, and tokenized economic-exposure wrappers distributed through Republic. Holders of each will track the same financial statements.
That dual structure is now a live test of the SEC Division of Corporation Finance’s January 2026 staff statement on tokenized securities, which warned that wrapping a security in token form “does not change the fundamental nature of the underlying security.” Republic and Animoca will be the first scaled issuance regulators get to grade against that line.
A Six-Year Round Trip Through Crypto
Animoca’s ASX exit is the part of this story most coverage has skipped. The ASX’s March 2020 official removal notice for Animoca Brands ended a five-year listing that started on January 23, 2015. The delisting forced the company into private fundraising, where Temasek and GGV Capital led a $110 million round in August 2022 at a $6 billion valuation. The portfolio has grown from about 540 investments at the end of 2024 to more than 600 today.
Tokenizing Animoca Brands’ equity on Solana showcases what Internet Capital Markets make possible, instant, global access to private company ownership. Solana’s high-performance infrastructure ensures that tokenized shares can move with the same speed and efficiency as the internet itself.
Those words came from Lily Liu, President of the Solana Foundation, in the joint announcement. The framing matters: the company that lost its public listing for crypto activity is now the showcase asset for crypto-native public markets. Yat Siu, Co-Founder and Executive Chairman of Animoca Brands, has been blunt about why on the speaking circuit, calling 2026 “the year of the utility token” on Jacquelyn Melinek’s December 2025 podcast and telling audiences the broader industry must “tokenize or die.”
Inside Republic’s Mirror Token Playbook
Mirror Tokens are Republic’s Mirror Tokens program documentation applied to private-company exposure at retail scale. Republic has already deployed the wrapper for SpaceX. The Animoca offering is the first tied to a Web3-native company at this size.
Each Mirror Token gives holders economic exposure that tracks the underlying equity, distributed under existing securities exemptions. They sit on-chain, transfer only between whitelisted wallets, and resolve to cash settlement at defined corporate events such as a sale, merger, or public listing.
Republic has been explicit that Mirror Tokens do not carry voting rights and are not equivalent to holding common stock on a cap table. That distinction is the operating reality even when the marketing leans into the language of ownership.
| Feature | Mirror Token | Nasdaq Common Stock |
|---|---|---|
| Minimum buy-in | About $50 | One share at market price |
| Eligibility | Public, no accreditation required | Anyone with a brokerage account |
| Trading hours | 24/7 once listed | Nasdaq market hours |
| Right conferred | Economic exposure | Direct ownership and voting |
| Settlement rail | On-chain, Solana | DTCC, T+1 |
The table is the cleanest answer to the question retail investors keep asking on Republic’s interest forms: am I buying the same thing a Nasdaq investor will buy after the merger? No. You’re buying something cheaper to access, faster to trade, and structurally junior on rights.
Solana’s RWA Surge In Hard Numbers
The Animoca deal arrives with Solana already running hot in the real-world-asset segment. The chain has spent 2025 and early 2026 turning into the default settlement layer for tokenized stocks, treasuries, and private equity wrappers.
The numbers behind that shift, drawn from the Solana Foundation’s State of Solana February 2026 report and related ecosystem data:
- $1.71 billion Solana RWA market cap, an all-time high recorded in late February 2026, up 45% in 30 days
- 325% growth across calendar 2025, lifting the segment from roughly $200 million in January 2025 to about $873 million by January 2026
- 55-plus tokenized equities already live on Solana through xStocks, including wrappers of Apple and Tesla
- $18.9 trillion projected total tokenized-asset market by 2033, per the joint Ripple and BCG forecast
What Yat Siu Is Telling Markets Now
Siu has spent the past six months running a public campaign for tokenized equity. In a January 2026 Invezz interview he argued identity and intellectual-property tokenization will drive mainstream adoption. A March 2026 CoinShares conversation cast Animoca itself as “a gateway to the utility tokens of Web3.”
His framing matters because Animoca is doing both at once. The Nasdaq merger gives the company access to traditional capital and the disclosure regime that comes with it. The Solana token gives it a retail distribution channel no listed peer has at this scale.
If Republic ships the offering before the Nasdaq close, Animoca becomes the first live experiment in whether retail crypto demand can meaningfully price a private-then-public company in real time. The answer arrives this year, and the SEC will be reading the filings.
Frequently Asked Questions
Can I Buy Tokenized Animoca Shares Today?
Not yet. As of May 2026 the offering is in waitlist mode at republic.com/animoca. Existing Animoca shareholders can claim tokens directly by registering a whitelisted Solana wallet. New buyers can submit interest, get notified when the public sale opens, and clear Republic’s identity and jurisdiction checks before any allocation. Republic has not posted a public sale date, token price, or hard cap.
Do These Tokens Give Me Voting Rights At Animoca?
No. Republic’s Mirror Token structure provides economic exposure to the underlying equity but does not carry shareholder voting rights, board nomination rights, or a seat on Animoca’s cap table. If you want a voting interest, the relevant route is buying common stock in the merged Currenc-Animoca entity once it lists on Nasdaq, expected to close in 2026 under ticker CURR pending regulatory and shareholder approvals.
What Happens To My Token When The Nasdaq Merger Closes?
Republic has not published the conversion mechanics yet. Mirror Tokens typically resolve to cash settlement or a defined exchange ratio at corporate events like a merger or IPO. Watch the republic.com/animoca update page for the binding terms before the Currenc reverse merger closes, and read the offering memorandum carefully for any forced redemption, lockup, or pro-rata adjustment language.
Is This Legal Where I Live?
Eligibility depends on your country and accreditation status. Republic typically segments offerings between Regulation D for accredited US investors and Regulation S for non-US buyers, with several jurisdictions blocked entirely. The Republic platform runs a residency check during signup. If your country shows as restricted, no waitlist conversion or wallet whitelist will be possible regardless of how much capital you commit.
How Is This Different From Buying Animoca On An OTC Desk?
Three differences matter. The minimum drops from tens of thousands of dollars on OTC desks to roughly $50 on Republic. Settlement runs on Solana in seconds rather than over multi-day broker workflows. And secondary trading is concentrated on Republic’s marketplace instead of fragmented across private brokers, which should narrow bid-ask spreads once volume builds. The trade-off is the lack of voting rights.
Republic and Animoca have framed this as a precedent. The truthful read is narrower: it’s the first time a Web3 company with a real $1 billion-plus public path is using tokenization as a parallel distribution rail, and the SEC’s January 2026 staff guidance will get its first scaled stress test in the process. Whether the experiment ends as a template or a cautionary tale depends on what trades, at what price, on Solana the morning the offering finally goes live.
NEWS
Hormuud Bets $19 Down Will Finally Pull Somalia Online
Mogadishu’s biggest telecom operator just put a smartphone within reach of almost every adult in the country for the price of a chai habit. Hormuud Telecom and device financier Get-Phone launched Somalia’s first structured smartphone financing program at the Decale Hotel on May 5, 2026, opening enrollment with a $19 deposit and daily payments of $0.60. The plan targets 10,000 devices by June and 100,000 by year-end, then expands into Puntland and Somaliland.
The math is what makes this story land. The average Hormuud customer already spends roughly $0.50 per day on data and minutes. Adding a smartphone to that line item costs them another 10 cents.
Behind the simple numbers sits a quieter story: this is less a phone deal than a credit infrastructure rollout dressed up as one. The repayment engine is Hormuud’s EVC Plus mobile money platform, which the operator says serves roughly four million customers, and the underwriting layer scores eligibility from SIM-usage patterns, not bank statements.
The Deal That Costs Less Than Lunch
Customers walk into a Hormuud branch, pay $19 up front, and walk out with an internet-ready handset the same day. From that point, $0.60 lands daily on the device through EVC Plus. The fee bundles 1GB of mobile data, 40 minutes of voice calls, and the device installment in a single charge.
Repayment terms run six to 12 months. Get-Phone CEO Omar Abdi confirmed the structure is interest-free and Sharia-compliant, which lets the program reach the large share of Somalis who refuse conventional credit on religious grounds.
That is not a marketing line. Somalia’s mobile money market runs on Islamic-finance principles by default, and any device-financing model that smuggled riba into the contract would have died on contact with the Mogadishu street.

How $0.60 A Day Actually Works
The headline price hides three different things: a hardware payment, a data bundle, and a voice allowance, all settled through the same daily mobile-money debit. Strip the bundle out and the marginal cost of the smartphone over a feature phone is roughly 10 cents per day, since most customers already spend $0.50 daily on prepaid airtime and data.
Eligibility runs on a proprietary scoring engine that reads how a SIM has behaved over time. Top-up cadence, voice patterns, length of network tenure, and EVC Plus transaction history feed the model. No bank statement, no formal employment proof, no national ID requirement for most applicants.
A second layer hardens the underwriting: a family-guarantor mechanism, where a relative co-signs through their own SIM. The structure leans on Somalia’s clan and family networks rather than against them, and that detail mattered during the pilot.
Here is what the pricing block looks like in practice.
- $19: one-time deposit at any Hormuud or Get-Phone counter
- $0.60 per day: device installment plus 1GB data plus 40 minutes of voice
- 6 to 12 months: repayment window, interest-free
- 4 million: existing EVC Plus customers who can repay through the same wallet they already top up
Why EVC Plus Is The Real Engine
Mobile money in Somalia is not an alternative payment method. It is the payment method. A 2025 Frontiers study on EVC Plus and humanitarian aid delivery documented the platform’s reach at over 80 percent of the adult population in southern and central Somalia, with daily transaction volumes that dwarf the country’s banking sector.
That base is what allows daily-rate device repayment to work at all. A Kenyan or Nigerian operator running the same product would face card declines, USSD timeouts, and bank-rail friction. In Somalia, $0.60 deducts from an EVC Plus wallet in seconds.
| Variable | Hormuud / Get-Phone | M-Kopa (Kenya) |
|---|---|---|
| Upfront deposit | $19 | ~$15 to $35 |
| Daily payment | $0.60 (bundles data and voice) | ~$0.45 to $0.65 (device only) |
| Repayment rail | EVC Plus mobile money | M-Pesa |
| Pilot default rate | Under 4% | Around 10% market average |
| Compliance frame | Sharia-compliant, interest-free | Conventional interest model |
The Sharia-Compliance Twist Mainstream Banks Couldn’t Crack
Conventional device financing in Muslim-majority markets has stalled for years on a single problem: interest. A standard installment plan with a stated APR is haram under most local interpretations, and households simply refuse it. Get-Phone’s contract is structured along ijarah and murabahah lines, where the financier owns the device, sells it forward at a fixed markup, and collects in known installments.
That structure is not exotic in Somalia. It is the default. Salaam Somali Bank, Premier Bank, and Kaah International Microfinance Services have all built consumer products on the same legal scaffolding, and Hormuud chose to plug into it rather than fight it.
This program is built on the belief that when you give people access to the right tools at the right price, they will do extraordinary things, said Get-Phone CEO Omar Abdi at the Decale Hotel launch.
A 4% Default Rate That Caught Lenders Off Guard
The most under-reported number from Tuesday’s launch is the pilot default rate. Hormuud said the February-to-March Mogadishu pilot recorded delinquency below 4 percent. M-Kopa, the most successful pay-as-you-go device financier in East Africa, has openly said its market default rate sits closer to 10 percent in Kenya, and the company has fought legal battles over its enforcement tactics.
Hormuud’s number is genuinely low for an unbanked-population product. Two design choices explain it.
First, the family-guarantor mechanism. A delinquent borrower drags a named relative’s SIM into the same delinquency status, which collapses voice, data, and EVC Plus access for both parties at once. Social cost replaces legal cost.
Second, the same SIM that owes money is the SIM the borrower depends on for income, banking, and family contact. There is no walking away from a Hormuud number in Somalia. The asset and the collateral are the same object.
If that 4 percent figure holds at 100,000 devices, the program crosses the threshold where international development financiers and impact funds typically step in. A loan book performing inside 4 percent loss is investment-grade by emerging-market standards.
ZTE Devices And What They Mean For Margins
Mainstream coverage skipped the supply side entirely. Get-Phone’s product page lists ZTE as the curated handset partner, which lines up with the broader pattern across low-margin African device financing: Chinese OEMs are the only ones willing to ship sub-$100 4G devices in volume with the LTE bands East African networks need.
The choice has consequences. ZTE’s bill of materials at this tier sits well under $50, leaving room inside Get-Phone’s contract for the markup that funds the financing risk. A Samsung or Xiaomi device at the same price band would have left no room for either bundled data or a 4 percent default cushion.
Vision 2060 And The GDP Math Behind The Pitch
Deputy Prime Minister Salah Ahmed Jama framed the rollout as a building block of Somalia’s Centennial Vision 2060, the long-term plan to lift the country to middle-income status by mid-century. “A smartphone today is far more than a device; it is a gateway to commerce, education, and opportunity,” Jama said at the launch.
The macro case is real. A World Bank background paper for the World Development Report found that a 10-percentage-point increase in fixed broadband penetration lifts GDP growth by roughly 1.38 percent in developing economies. GSMA’s 2025 Mobile Economy Africa report went further, projecting that closing the continent’s mobile internet usage gap by 2030 could add around $700 billion to African GDP.
Where Somalia sits today makes the upside concrete.
- 11.5 million: active mobile connections, equal to 58.1 percent of the population
- 27.6 percent: individual internet penetration at the end of 2025
- 75.7 percent: share of mobile connections already on 3G, 4G, or 5G
- 22.7 percent vs 47.1 percent: rural versus urban internet access reported in Somalia’s Digital Inclusion Policy
- Sixth of annual income: typical upfront cost of an entry smartphone before this program
Frequently Asked Questions
How Do I Sign Up For The Get-Phone Smartphone Plan In Mogadishu?
Walk into any Hormuud branch or Get-Phone service point with an active Hormuud SIM and $19 in cash or EVC Plus balance. Staff verify your number against the SIM-usage credit score, register a family guarantor where required, and hand over the device the same day. Daily $0.60 deductions begin from your EVC Plus wallet the next morning, and the eGet customer app tracks your remaining balance in real time.
What Happens If I Miss A Daily Payment?
Short grace periods apply, then the device’s data and voice features pause until the wallet is topped up. The handset is not bricked outright in the early window. If delinquency runs longer, the family guarantor’s SIM is flagged too, which is the social pressure point that kept pilot defaults below 4 percent. Long-term non-payment can lead to device deactivation and recovery under the Sharia-compliant ijarah terms.
Is This Plan Actually Interest-Free Under Islamic Finance Rules?
Yes. Get-Phone CEO Omar Abdi confirmed at the May 5 launch that the contract is structured along Sharia-compliant lines, with the financier owning the device and selling it forward at a known markup rather than charging riba. The total amount you pay across six to 12 months is fixed at signing, and there are no late-payment interest charges added. Customers can request the contract documentation in Somali or English at any branch.
Can I Use The Phone On A Network Other Than Hormuud?
Not during the financing period. The device is tied to your Hormuud SIM, since the SIM doubles as your identity, your credit file, and your repayment rail through EVC Plus. Once you complete the six-to-12-month term, ownership transfers and the device unlocks for use on other carriers. Hormuud has not yet published a buy-out option for early settlement, but Get-Phone branches in Mogadishu are accepting written queries.
When Will The Program Reach Puntland And Somaliland?
Hormuud said the second wave starts after the 10,000-device Mogadishu phase clears in June 2026, with the 100,000-device national target running through December. Puntland’s Bosaso and Garowe and Somaliland’s Hargeisa are flagged as the first regional launches. Customers outside Mogadishu can register interest through the eGet app or at Hormuud retail outlets, and the company has committed to publishing a regional rollout calendar on its corporate updates page as zones come online.
If the pilot’s 4 percent default rate holds at scale, the program stops being a corporate social responsibility story and turns into something rarer: a viable consumer-credit business built on top of a mobile-money rail in a country where formal banking still touches under 10 percent of adults. That is the lever that turns Hormuud’s masts into smartphones, and smartphones into the GDP line that Vision 2060 has been chasing on paper for a year. The next 100,000 devices will tell whether the math survives contact with the rest of the country.
-
APPS18 hours agoGoogle’s Buried Page Reveals 500 Niche Websites Still Making Cash
-
NEWS4 hours agoHormuud Bets $19 Down Will Finally Pull Somalia Online
-
GAMING4 hours agoAsha Sharma Reshuffles Xbox Leadership In Race To Project Helix
-
CRYPTO4 hours agoAndreessen Horowitz Bets $2.2B on Crypto’s Quiet Cycle
-
CRYPTO4 hours agoMoonPay Buys DFlow For $100M, Grabs Solana’s Execution Layer
-
AI4 hours agoDriscoll Pushes Nine Defense Giants to Open Code at Fort Carson
-
CRYPTO4 hours agoRepublic Tokenizes Animoca Brands Equity on Solana for Retail Buyers
-
CRYPTO4 hours agoWells Fargo Says Circle Is Crypto’s Underappreciated Winner
