Cybersecurity and data breaches

By sector

Sector is the SEC's industry description of the company. Each count opens that sector's quotes below.

528 paragraphs · Finance Services show all sectors

•cyber theft of Bitcoin from online wallet providers or news of such theft from such providers or from individuals’ online wallets;

Read in the 10-K filed Mar 27, 2026 ↗

Should one of our pool operator’s systems suffer downtime due to a cyberattack, software malfunction, or other similar issues, it will negatively impact our ability to receive Bitcoin mining rewards. Furthermore, we are dependent on the accuracy of the mining pool operators’ record keeping and internal controls to prevent any fraud and to accurately record the total processing power provided by us and other mining pool participants for a given Bitcoin mining application in order to assess the proportion of that total processing power we provided. While we have internal methods of tracking both our processing power provided and the total used by the pool, the mining pool operator uses its own recordkeeping to determine our proportion of a given reward. We have little means of recourse against mining pool operators if we determine the proportion of the reward paid out to us by the mining pool operator is incorrect, other than leaving the pool. If we are unable to consistently obtain accurate proportionate rewards from our mining pool operators, we may experience reduced reward for our efforts, which would have an adverse effect on our business, financial condition, and results of operations.

Read in the 10-K filed Mar 27, 2026 ↗

The characteristics of Bitcoin have been, and may in the future continue to be, exploited to facilitate illegal activity such as fraud, money laundering, tax evasion, and ransomware scams. Furthermore, the exchanges on which Bitcoin trades are relatively new and, in most cases, largely unregulated and may therefore be more exposed to fraud and failure than established, regulated exchanges for other assets. Such circumstances may result in a reduction in the price of Bitcoin and can adversely affect our business, financial condition, and results of operations.

Read in the 10-K filed Mar 27, 2026 ↗

While we maintain policies and procedures reasonably designed to promote compliance with applicable anti-money laundering and sanctions laws, if we are found to have transacted with bad actors that have used Bitcoin to launder money or persons subject to sanctions, we may be subject to regulatory proceedings and may be prohibited or restricted from engaging in further transactions or dealings in Bitcoin. Furthermore, negative perception, a lack of stability in the broader Bitcoin markets, and the closure or temporary shutdown of Bitcoin exchanges due to fraud, business failure, hackers, malware, or government-mandated regulation may reduce confidence in Bitcoin and result in greater volatility in the prices of Bitcoin. A number of Bitcoin exchanges have been closed due to fraud, failure, or security breaches. In many of these instances, the customers of such Bitcoin exchanges were not compensated or made whole for the partial or complete losses of their account balances in such Bitcoin exchanges. To the extent investors view our securities as linked to the value of our Bitcoin holdings, such a negative perception of Bitcoin exchanges could have a material adverse effect on the market price of our Class A common stock and our business, financial condition, and results of operations.

Read in the 10-K filed Mar 27, 2026 ↗

•physical and cybersecurity breaches, including security breaches of infrastructure maintained by our suppliers, including Hut 8;

Read in the 10-K filed Mar 27, 2026 ↗

Threats to network and data security are increasingly diverse and sophisticated, such that security breaches, computer malware, and computer hacking attacks have been an increasing concern. Despite our efforts and processes in place to prevent them, our computer servers and systems may be vulnerable to cybersecurity risks, including denial-of-service attacks, physical or electronic break-ins, social engineering attacks, including phishing and business email compromise, employee theft or misuse, and similar disruptions from unauthorized tampering. As techniques used to breach security change frequently and are generally not recognized until launched against a target, we may not be able to promptly detect that a cyber breach has occurred, implement security measures in a timely manner, or, if and when implemented, we may not be able to determine the extent to which these measures could be circumvented.

Read in the 10-K filed Mar 27, 2026 ↗

Recent developments in the cyber threat landscape include use of artificial intelligence ("AI") and machine learning, as well as an increased number of cyber extortion and ransomware attacks, with the potential for higher ransom demand amounts and increasing sophistication, using a variety of ransomware techniques and methodology. Further, any adoption of AI by us or by third parties may pose new security challenges. A party who is able to compromise the security measures on our networks or the security of our infrastructure could misappropriate our or our employees’ proprietary or sensitive information or cause interruptions or malfunctions in our operations.

Read in the 10-K filed Mar 27, 2026 ↗

We also may be required to expend significant capital and resources to protect against such threats or to alleviate problems caused by cyber breaches in our physical or virtual security systems. The cybersecurity regulatory landscape continues to evolve and compliance with the proposed reporting requirements could further complicate our ability to resolve cyberattacks. Although we maintain insurance coverage for certain cyber risks, such coverage may be unavailable or insufficient to cover our losses. Any breaches that may occur in the future could expose us to increased risk of lawsuits, regulatory penalties, damage relating to loss of proprietary information, harm to our reputation, and increases in our security costs, which could have a material adverse effect on our business, financial condition, and results of operations. Furthermore, we hold our Bitcoin with third-party custodians. If our custodians are exposed to a cyberattack or breach, we may temporarily or permanently lose access to some or all of our Bitcoin, which would have a material adverse effect on our business, financial condition, and results of operations. See "—Risks Related to Bitcoin—We may be subject to additional risks associated with holding Bitcoin for our own account and with pledging our Bitcoin." The cybersecurity regulatory landscape continues to evolve and compliance with the proposed reporting requirements could further complicate our ability to resolve cyberattacks. Although we maintain insurance coverage for certain cyber risks, such coverage may be unavailable or insufficient to cover our losses.

Read in the 10-K filed Mar 27, 2026 ↗

If we or our third-party service providers experience a security breach or cyberattack and unauthorized parties obtain access to our bitcoin holdings, or if our private keys are lost or destroyed, or other similar circumstances or events occur, we may lose some or all of our bitcoin and our financial condition and results of operations could be materially adversely affected.

Read in the 10-K filed Mar 19, 2026 ↗

We expect that substantially all of the bitcoin we will acquire will be held in custody accounts at U.S.-based institutional-grade digital asset custodians. Our custodial services contracts are not expected to restrict our ability to reallocate our bitcoin among our custodians, and our bitcoin holdings may be concentrated with a single custodian from time to time. Security breaches and cyberattacks are of particular concern with respect to bitcoin. Bitcoin and other blockchain-based cryptocurrencies and the entities that provide services to participants in the bitcoin ecosystem have been, and may in the future be, subject to security breaches, cyberattacks, or other malicious activities. For example, in October 2021 it was reported that hackers exploited a flaw in the account recovery process and stole from the accounts of at least 6,000 customers of the Coinbase exchange, although the flaw was subsequently fixed and Coinbase reimbursed affected customers. Similarly, in November 2022, hackers exploited weaknesses in the security architecture of the FTX Trading digital asset exchange and reportedly stole over $400 million in digital assets from customers.

Read in the 10-K filed Mar 19, 2026 ↗

Further, any actual or perceived data security breach or cybersecurity attack directed at other companies with digital assets or companies that operate digital asset networks, regardless of whether we are directly impacted, could lead to a

Read in the 10-K filed Mar 19, 2026 ↗

In addition, bitcoin is controllable only by the possessor of both the unique public key and private key(s) relating to the local or online digital wallet in which the bitcoin is held. While the Bitcoin blockchain ledger requires a public key relating to a digital wallet to be published when used in a transaction, private keys must be safeguarded and kept private in order to prevent a third party from accessing the bitcoin held in such wallet. To the extent the private key(s) for a digital wallet are lost, destroyed, or otherwise compromised and no backup of the private key(s) is accessible, neither we nor our custodians will be able to access the bitcoin held in the related digital wallet. Furthermore, Strive cannot provide assurance that its digital wallets, nor the digital wallets of our custodians held on our behalf, will not be compromised as a result of a cyberattack. The bitcoin and blockchain ledger, as well as other digital assets and blockchain technologies, have been, and may in the future be, subject to security breaches, cyberattacks, or other malicious activities.

Read in the 10-K filed Mar 19, 2026 ↗

Attacks upon systems across a variety of industries, including industries related to bitcoin and financial services, are increasing in frequency, persistence, and sophistication, and, in many cases, are being conducted by sophisticated, well-funded and organized groups and individuals, including state actors. The techniques used to obtain unauthorized, improper or illegal access to systems and information (including personal data and digital assets), disable or degrade services, or sabotage systems are constantly evolving, may be difficult to detect quickly, and often are not recognized or detected until after they have been launched against a target. These attacks may occur on our systems or those of our third-party service providers or partners. In 2025, we have not identified any cybersecurity threats or incidents, including those resulting from any previous cybersecurity incidents, that have materially affected, or, to our knowledge, are reasonably likely to materially affect, us or our business strategy, results of operations or financial condition. However, we may, in the future, experience breaches of our security measures due to human error, malfeasance, insider threats, system errors or vulnerabilities or other irregularities. In particular, we expect that unauthorized parties will attempt to gain access to our systems and facilities, as well as those of our partners and third-party service providers, through various means, such as hacking, social engineering, phishing and fraud. Threats can come from a variety of sources, including criminal hackers, hacktivists, state-sponsored intrusions, industrial espionage, and insiders. In addition, certain types of attacks could harm us even if our systems are left undisturbed. For example, certain threats are designed to remain dormant or undetectable, sometimes for extended periods of time, until launched against a target and we may not be able to implement adequate preventative measures. Further, there has been an increase in such activities due to the increase in work-from-home arrangements. The risk of cyberattacks could also be increased by cyberwarfare in connection with the ongoing Russia-Ukraine and Israel-Hamas conflicts, or other future conflicts, including potential proliferation of malware into systems unrelated to such conflicts. Any future breach of our operations or those of others in the bitcoin or financial services industries, including third-party services on which we rely, could materially and adversely affect our financial condition and results of operations.

Read in the 10-K filed Mar 19, 2026 ↗

We face risks from fraudulent activity associated with Card Members, merchants and others, including through bad actors obtaining access to our customer accounts and information and frauds committed by our customers against us. Large financial services firms such as American Express and our customers are regularly targeted by a range of fraudulent activity, including fraud on our card and banking products, false disputes, account takeovers, identity theft and electronic-transaction related crimes, with sophisticated perpetrators increasingly utilizing a range of advanced techniques and multiple parties acting in concert. New or emerging technologies, such as generative AI capabilities, have increased these fraud risks. For example, we have seen our customers targeted by elaborate and voluminous social engineering attacks, which may utilize advanced methods of deception, such as synthetic voice and conversation generation. Information and cybersecurity breaches and other operational incidents that we or third parties experience also increase our fraud risk. Additionally, our introduction of new products and services, expansion into new jurisdictions or usage of new partners or vendors may create new fraud risks or heighten existing risks. While we have policies and procedures designed to address fraud risks, such as customer authentication controls and fraud detection systems, they may be insufficient to accurately predict, prevent or detect fraud.

Read in the 10-K filed Feb 6, 2026 ↗

To the extent we pursue our Investment Policy, we expect that our Bitcoin and digital assets may be held by a third-party custodian, and the safety of those assets is dependent on the custodian's security practices and operational integrity, which may lead to the loss of our digital assets as a result of the insolvency of the custodian, theft by employees or insiders of the custodian or if the custodian's security measures are compromised, including as a result of cyberattacks. A successful security breach or cyberattack could result in a partial or total loss of our Bitcoin in a manner that may not be covered by insurance or indemnity provisions of the custody agreement with a custodian who holds our Bitcoin. Such a loss could have a material adverse effect on our financial condition and results of operations.

Read in the 10-K filed Mar 19, 2026 ↗

Digital asset trading venues are relatively new and, in many cases, unregulated. Furthermore, there are many digital asset trading venues which do not provide the public with significant information regarding their ownership structure, management teams, corporate practices and regulatory compliance. As a result, the marketplace may lose confidence in digital asset trading venues, including prominent exchanges that handle a significant volume of Bitcoin trading and/or are subject to regulatory oversight, in the event one or more digital asset trading venues cease or pause for a prolonged period the trading of any digital assets, or experience fraud, significant volumes of withdrawal, security failures or operational problems. Negative perception, a lack of stability in the broader digital asset markets and the closure, temporary shutdown or operational disruption of digital asset trading venues due to fraud, business failure, cybersecurity events, government-mandated regulation, bankruptcy, or for any other reason, may result in a decline in confidence in Bitcoin and the broader digital asset ecosystem and greater volatility in the price of Bitcoin and other digital assets.

Read in the 10-K filed Mar 19, 2026 ↗

Cybersecurity, data privacy and intellectual property risks: Cybersecurity incidents may compromise systems; intellectual property disputes or alleged infringements could disrupt our business; accounting for digital assets and fair value measurements; potential impairment charges; auditor transitions; internal control considerations.

Read in the 10-K filed Nov 21, 2025 ↗

security issues, bugs, and software errors have been identified with many digital assets and their underlying blockchain networks, some of which have been exploited by malicious actors. There are also inherent security weaknesses in some digital assets, such as when creators of certain blockchain networks use procedures that could allow hackers to counterfeit tokens. Any weaknesses identified with a digital asset could adversely affect its price, security, liquidity, and adoption rate. If one or more malicious actors obtain a majority of the compute or staking power on a digital asset network, as has happened in the past, it may be able to engage in illicit activity, which could cause financial losses to holders, damage the network’s reputation and security, and adversely affect its value;

Read in the 10-K filed Nov 21, 2025 ↗

Our rewards are typically earned via pooled mining. We rely on pool operators to honestly and accurately account for our pro rata share of rewards, maintain operational security, and remit proceeds. Pools may lack insurance for theft or loss, and rewards may be held for varying durations. Any failure, insolvency, cyber event, mispricing, or suspension by a pool operator could delay or reduce our receipts or result in losses. A change in pool fee structures or terms could adversely affect yields.

Read in the 10-K filed Nov 21, 2025 ↗

Cybersecurity incidents, including data breaches and ransomware, may compromise systems, disrupt operations, and cause financial loss.

Read in the 10-K filed Nov 21, 2025 ↗

security issues, bugs, and software errors have been identified with many digital assets and their underlying blockchain networks, some of which have been exploited by malicious actors. There are also inherent security weaknesses in some digital assets, such as when creators of certain blockchain networks use procedures that could allow hackers to counterfeit tokens. Any weaknesses identified with a digital asset could adversely affect its price, security, liquidity, and adoption rate. If one or more malicious actors obtain a majority of the compute or staking power on a digital asset network, as has happened in the past, it may be able to engage in illicit activity, which could cause financial losses to holders, damage the network’s reputation and security, and adversely affect its value;

Read in the 10-K filed Mar 27, 2026 ↗

Our rewards are typically earned via pooled mining. We rely on pool operators to honestly and accurately account for our pro rata share of rewards, maintain operational security, and remit proceeds. Pools may lack insurance for theft or loss, and rewards may be held for varying durations. Any failure, insolvency, cyber event, mispricing, or suspension by a pool operator could delay or reduce our receipts or result in losses. A change in pool fee structures or terms could adversely affect yields.

Read in the 10-K filed Mar 27, 2026 ↗

WhiteFiber believes that the successful use of its platform requires a high level of support and engagement for many of its customers. In order to deliver appropriate customer support and engagement, WhiteFiber must successfully assist its customers in deploying and continuing to use its platform, resolve performance issues, address interoperability challenges with the customers’ existing IT infrastructure, and respond to security threats and cyber-attacks and performance and reliability problems that may arise from time to time. Increased demand for customer support and cloud operations services, without corresponding increases in revenue, could increase its costs and adversely affect its business, operating results, financial condition, and future prospects.

Read in the 10-K filed Mar 27, 2026 ↗

result in exposure to claims for damages and other remedies by WhiteFiber’s customers and individuals whose personal data is the subject to a cybersecurity incident;

Read in the 10-K filed Mar 27, 2026 ↗

For example, California has enacted the California Consumer Privacy Act (“CCPA”) and the California Privacy Rights Act (“CPRA”), which, among other things, allows California consumers to request that certain companies disclose the types of personal information collected by such companies, to correct that information, to delete that information and to opt-out the sale or sharing of personal information for cross-context behavioral advertising. The California Privacy Protection Agency (“CPPA”) has proposed new regulations to require companies to conduct risk assessments, annual cybersecurity audits and set up notice and opt-out and access procedures for the use of automated decision-making technology. These proposed new requirements could increase our costs of compliance and impact our operations and the products and services we offer.

Read in the 10-K filed Mar 27, 2026 ↗

We conduct periodic cybersecurity risk assessments to identify reasonably foreseeable internal and external cybersecurity threats, including assessments conducted in connection with material changes to our business operations, systems, or third-party relationships. These risk assessments evaluate, among other things, the potential likelihood and magnitude of harm from such risks, including potential impacts on our operations, financial condition, reputation, digital assets, and business strategy, as well as the effectiveness of existing controls and safeguards.

Read in the 10-K filed Mar 26, 2026 ↗

Risk assessments consider information from internal stakeholders, known security vulnerabilities, threat intelligence, reported incidents affecting other companies in our industry, and information obtained from third parties and external advisors, as appropriate. The results of these assessments are used to inform enhancements to our cybersecurity controls, operational processes, and broader Company-wide risk management activities, which are periodically reported to management and the Audit Committee.

Read in the 10-K filed Mar 26, 2026 ↗

We maintain a cybersecurity incident response and recovery plan designed to guide our response to cybersecurity incidents. The plan provides a structured framework for incident identification, containment, investigation, remediation, and recovery, and includes defined escalation and communication protocols. In the event of a cybersecurity incident, management evaluates the incident to determine its severity and potential impact, including whether the incident is reasonably likely to be material, based on both quantitative and qualitative factors.

Read in the 10-K filed Mar 26, 2026 ↗

We maintain a vendor risk management program designed to identify and mitigate cybersecurity risks associated with third-party service providers. Third-party providers are subject to cybersecurity risk assessments during onboarding, contract renewal, and upon the identification of elevated risk. These assessments may include questionnaires, management discussions, third-party intelligence, and review of available SOC reports or similar assurances. Cybersecurity incidents affecting third-party providers are evaluated for potential impact to the Company, as appropriate.

Read in the 10-K filed Mar 26, 2026 ↗

Our policies require employees and relevant third-party contractors to contribute to our cybersecurity efforts. We provide periodic cybersecurity and data protection awareness training and require the prompt reporting of suspicious activity or potential cybersecurity incidents to management.

Read in the 10-K filed Mar 26, 2026 ↗

Our Board retains ultimate oversight responsibility for cybersecurity risk. The Board has delegated primary oversight of cybersecurity and information technology risks to the Audit Committee as part of its risk oversight function.

Read in the 10-K filed Mar 26, 2026 ↗

In the event of a cybersecurity incident, management evaluates the incident and, as appropriate, escalates matters to the Audit Committee and the Board. The Audit Committee receives periodic updates regarding cybersecurity risks, program effectiveness, and any material cybersecurity incidents. The Audit Committee also meets regularly with the Company’s independent registered public accounting firm and discusses cybersecurity risks relevant to financial reporting and internal controls, as appropriate.

Read in the 10-K filed Mar 26, 2026 ↗

Our business depends on providing tenants with highly reliable services, including with respect to physical security, cybersecurity, and maintenance of environmental conditions. We may fail to provide such services because our operations are vulnerable to, among other things, mechanical or telecommunications failure, power outage, human error, physical or electronic security breaches, cyberattacks, war, terrorism, fire, earthquake, pandemics, hurricane, flood and other natural disasters, sabotage and vandalism.

Read in the 10-K filed Feb 24, 2026 ↗

We and our third-party service providers face numerous and evolving cybersecurity risks and regularly identify, defend against and recover from a variety of cyber-attacks, including phishing and other efforts to gain unauthorized access to systems. These risks may increase as we grow, as our operations become more complex and as threat actors become more sophisticated, including through the use of artificial intelligence and other advanced techniques designed to circumvent security controls, evade detection or remain dormant for extended periods. Remote and hybrid working arrangements at our company and at many of our third-party providers may further increase cybersecurity risks due to challenges associated with managing distributed computing assets and non-corporate networks. In addition, any integration of artificial intelligence in our or our service providers’ or partners’ operations, products or services may pose new or unknown cybersecurity risks.

Read in the 10-K filed Feb 24, 2026 ↗

Despite our efforts to maintain and enhance cybersecurity controls and incident response and disaster recovery preparedness, including employee training, monitoring and preventative measures, we may be unable to detect, prevent, investigate, remediate or adequately recover from all cybersecurity incidents or IT Systems failures in a timely manner or at all. Security breaches or other cybersecurity incidents may arise from a variety of sources, including state-sponsored actors, opportunistic hackers, hacktivists, insiders, human or technological error, malware (including ransomware), social engineering or vulnerabilities in our or third-party systems. Certain attacks could harm us even if our systems are not directly compromised, including through disruptions at or vulnerabilities within third-party service providers on which we rely. We also may not be able to ensure the adequacy of the security measures implemented by our third-party service providers, custodians or counterparties, many of which store or process our sensitive data and digital assets.

Read in the 10-K filed Feb 24, 2026 ↗

A successful cybersecurity incident or IT Systems failure could result in, among other things, (i) interruptions to our operations or services; (ii) loss of control or impaired operation of our equipment; (iii) misappropriation or loss of personal data, Confidential Information or other critical data; and (iv) loss, theft or irretrievable loss of bitcoin or other digital assets. Such incidents could materially harm our business and reputation, require significant incident response, remediation or system restoration efforts and expenses, and expose us to governmental or regulatory investigations,

Read in the 10-K filed Feb 24, 2026 ↗

enforcement actions, litigation (including class actions), fines, penalties or other liabilities. In addition, a data breach or cybersecurity incident may trigger mandatory notification obligations under applicable privacy and data protection laws, which could result in negative publicity and a loss of confidence in our security measures.

Read in the 10-K filed Feb 24, 2026 ↗

Mitigating cybersecurity risks and responding to incidents has resulted, and may in the future result, in increased operating and capital costs for systems, technology, personnel, monitoring and compliance. Insurance coverage for cybersecurity incidents involving digital or cryptocurrency assets is limited, and we do not currently maintain cybersecurity insurance for such assets. As a result, losses, costs or damages arising from cybersecurity incidents or IT Systems failures may not be fully recoverable, if at all.

Read in the 10-K filed Feb 24, 2026 ↗

For example, the European Union (“EU”) Artificial Intelligence Act (“EU AI Act”), which entered into force on August 1, 2024 and will become enforceable in a gradual manner between 2025 and 2027, establishes, among other things, a risk-based governance framework for regulating AI systems operating in the EU. There is a risk that the EU AI Act could have a negative impact on our current or future use of AI. For example, the EU AI Act prohibits certain uses of AI systems and places numerous obligations on providers and developers of permitted AI systems, with heightened requirements based on AI systems that are considered high risk. This regulatory framework is expected to have a material impact on the way AI is regulated in the EU and beyond. Similarly, other jurisdictions, such as Canada with its Artificial Intelligence and Data Act and several U.S. states have also implemented or are considering similar regulatory frameworks or laws governing the development and deployment of AI generally or in specific contexts, as well as critical infrastructure cybersecurity legislation or regulations relating to data flows. Specific to AI law, in April 2023, the U.S. Federal Trade Commission, Department of Justice, Consumer Financial Protection Bureau and Equal Employment Opportunity Commission issued a joint statement on AI enforcement, demonstrating their interest in monitoring the development and use of automated systems and enforcement of their respective laws and regulations. The Federal Trade Commission and certain state Attorneys General have pursued enforcement actions against companies offering AI products and services under consumer protection laws. Such regulatory frameworks, as well as developing or potentially conflicting regulatory guidance and judicial decisions in this area, as well as conflict between potentially competing legal regimes (including with respect to state laws that may conflict with federal AI policy), may introduce uncertainty, affect our use of AI and our ability to provide and to improve our products and solutions, require additional compliance measures and changes to our operations and processes, result in increased compliance costs and potential increases in civil claims against us and could have a material adverse effect on our business, financial condition and results of operations.

Read in the 10-K filed Feb 24, 2026 ↗

increasingly difficult to detect, and come from a variety of sources, including traditional computer “hackers,” threat actors,

Read in the 10-K filed Mar 2, 2026 ↗

attacks, credential stuffing attacks, credential harvesting, physical or electronic break-ins, employee misconduct or error , ransomware

Read in the 10-K filed Mar 2, 2026 ↗

technology assets, adware, attacks enhanced or facilitated by AI, and other similar disruptions. In particular, severe ransomware

Read in the 10-K filed Mar 2, 2026 ↗

reputational harm, and diversion of funds. Extortion payments may alleviate the negative impact of ransomware attack, but we may be

Read in the 10-K filed Mar 2, 2026 ↗

cybersecurity risks and vulnerabilities, as our systems could be negatively affected by vulnerabilities present in acquired or integrated

Read in the 10-K filed Mar 2, 2026 ↗

consumer protection rules, anti-money laundering and sanctions requirements, and data and cybersecurity laws. U.S. federal regulators

Read in the 10-K filed Mar 2, 2026 ↗

additional stability, larger exchanges may be more likely to be appealing targets for hackers and “malware” (i.e., software used or

Read in the 10-K filed Mar 2, 2026 ↗

the digital asset exchange market and the closure or temporary shutdown of digital asset exchanges due to business failure, hackers or

Read in the 10-K filed Mar 2, 2026 ↗

relating to hackers and technological attack. Nevertheless, the security procedures cannot guarantee the prevention of any loss due to a

Read in the 10-K filed Mar 2, 2026 ↗

If we or our service providers experience a security breach or cyberattack and unauthorized parties obtain access to our digital assets, or if our private keys are lost or destroyed, or other similar circumstances or events occur, we may lose some or all of our digital assets and our financial condition and results of operations could be materially adversely affected.

Read in the 10-K filed Mar 30, 2026 ↗

Substantially all of the digital assets we own are held in custody accounts at U.S. institutional digital asset custodians. Security breaches and cyberattacks are of particular concern with respect to our digital assets. Solana and other blockchain cryptocurrencies and the entities that provide services to participants in the Solana ecosystem have been, and may in the future be, subject to security breaches, cyberattacks, or other malicious activities. For example, in October 2021 it was reported that hackers exploited a flaw in the account recovery process and stole from the accounts of at least 6,000 customers of the Coinbase exchange, although the flaw was subsequently fixed and Coinbase reimbursed affected customers. Similarly, in November 2022, hackers exploited weaknesses in the security architecture of the FTX Trading digital asset exchange and reportedly stole over $400 million in digital assets from customers. A successful security breach or cyberattack could result in:

Read in the 10-K filed Mar 30, 2026 ↗

Further, any actual or perceived data security breach or cybersecurity attack directed at other companies with digital assets or companies that operate digital asset networks, regardless of whether we are directly impacted, could lead to a general loss of confidence in the broader Solana ecosystem or in the use of the Solana Network to conduct financial transactions, which could negatively impact us.

Read in the 10-K filed Mar 30, 2026 ↗

Attacks upon systems across a variety of industries, including industries related to Solana, are increasing in frequency, persistence, and sophistication, and, in many cases, are being conducted by sophisticated, well organized groups and individuals, including state actors. The techniques used to obtain unauthorized, improper or illegal access to systems and information (including personal data and digital assets), disable or degrade services, or sabotage systems are constantly evolving, may be difficult to detect quickly, and often are not recognized or detected until after they have been launched against a target. These attacks may occur on our systems or those of our third-party service providers or partners. We may experience breaches of our security measures due to human error, malfeasance, insider threats, system errors or vulnerabilities or other irregularities. In particular, we expect that unauthorized parties will attempt to gain access to our systems and facilities, as well as those of our partners and third-party service providers, through various means, such as hacking, social engineering, phishing and fraud. Threats can come from a variety of sources, including criminal hackers, hacktivists, state intrusions, industrial espionage, and insiders. In addition, certain types of attacks could harm us even if our systems are left undisturbed. For example, certain threats are designed to remain dormant or undetectable, sometimes for extended periods of time, or until launched against a target and we may not be able to implement adequate preventative measures. Further, there has been an increase in such activities due to the increase in remote work arrangements. The risk of cyberattacks could also be increased by

Read in the 10-K filed Mar 30, 2026 ↗

or delays in our cloud or internal infrastructure or third-party services and cybersecurity incidents such as attacks on our

Read in the 10-K filed Mar 11, 2026 ↗

cybersecurity threats which may include attacks from malicious third parties, viruses, ransomware and other malicious

Read in the 10-K filed Mar 11, 2026 ↗

The cybersecurity threat landscape is rapidly evolving and has become increasingly sophisticated, and we may not be

Read in the 10-K filed Mar 11, 2026 ↗

successful in preventing or mitigating cybersecurity threats that could have a material adverse effect on us despite our

Read in the 10-K filed Mar 11, 2026 ↗

delay in or failure to detect a cybersecurity incident, or the full extent of an incident, could exacerbate its effects. We may

Read in the 10-K filed Mar 11, 2026 ↗

digital assets held at these platforms makes them appealing targets for hackers and a number of digital asset trading

Read in the 10-K filed Mar 11, 2026 ↗

do not provide the public with significant information regarding their management team, corporate practices, cybersecurity,

Read in the 10-K filed Mar 11, 2026 ↗

cybersecurity and data privacy. We could also inherit unforeseen liabilities, credit or compliance issues, or adverse

Read in the 10-K filed Mar 11, 2026 ↗

or anyone’s control. If Everstake or smart contracts fail to operate as expected, suffer cybersecurity attacks, experience

Read in the 10-K filed Mar 11, 2026 ↗

issues, cybersecurity incidents, disruptions, interruptions, and other misconduct of which we are not aware. Should any of

Read in the 10-K filed Mar 11, 2026 ↗

Our shift towards a SOL treasury-focused strategy, including staking, liquid staking, and other decentralized finance activities, exposes us to significant operational risks. To participate in Solana’s Proof-of-Stake consensus mechanism, we must either operate or delegate to validator nodes, and such validator nodes must keep software updated, maintain validator uptime and employ secure key management. In addition, the Solana ecosystem rapidly evolves, with frequent upgrades and protocol changes that may require significant adjustments to our operational setup if we are operating a validator node. The upgrades and protocol changes may require that we incur unanticipated costs and could cause temporary service disruptions to the Solana network. We may also need to employ third-party service providers in our operations, which may introduce risks outside of our control, including significant cybersecurity risks. Any of these operational risks could materially and adversely affect our ability to execute our SOL treasury strategy and may prevent us from realizing positive returns and could severely hurt our financial condition.

Read in the 10-K filed Dec 11, 2025 ↗

Negative perception, a lack of stability in the broader digital asset markets and the closure, temporary shutdown or operational disruption of digital asset trading venues, lending institutions, institutional investors, institutional miners, custodians, or other major participants in the digital asset ecosystem, due to fraud, business failure, cybersecurity events, government-mandated regulation, bankruptcy, or for any other reason, may result in a decline in confidence in digital assets and the broader digital asset ecosystem and greater volatility in the price of digital assets. The price of our listed securities may be affected by the value of our future digital asset holdings, and the failure of a major participant in the ecosystem could have a material adverse effect on the market price of our listed securities.

Read in the 10-K filed Dec 11, 2025 ↗

Digital asset lending arrangements may expose us to risks of borrower default, operational failures and cybersecurity threats.

Read in the 10-K filed Dec 11, 2025 ↗

Additionally, digital asset lending platforms are vulnerable to operational and cybersecurity risks. Technical failures, software bugs or system outages could disrupt lending activities, delay transactions or result in inaccurate record-keeping. Cybersecurity threats, including hacking, phishing and other malicious attacks, pose further risks, potentially leading to the loss, theft or misappropriation of our loaned SOL. A successful cyberattack or security breach could materially and adversely impact our financial position, reputation and ability to conduct future lending activities.

Read in the 10-K filed Dec 11, 2025 ↗

Decentralized finance arrangements may expose us to risks of smart contract risk, operational failures and cybersecurity threats.

Read in the 10-K filed Dec 11, 2025 ↗

The Company will face risks relating to the custody of its digital assets. If we or our third-party service providers experience a security breach or cyberattack and unauthorized parties obtain access to our private keys, or if our private keys are lost or destroyed, or other similar circumstances or events occur, we may lose some or all of our digital assets and our financial condition and results of operations could be materially adversely affected.

Read in the 10-K filed Dec 11, 2025 ↗

A cyberattack or other malicious attack on the Solana blockchain could have a material impact on the value of SOL held by the Company.

Read in the 10-K filed Dec 11, 2025 ↗

Solana and other digital assets and the entities that provide services to participants in blockchain ecosystems have been, and may in the future be, subject to security breaches, cyberattacks, or other malicious activities. For example, in October 2021 it was reported that hackers exploited a flaw in the account recovery process and stole from the accounts of at least 6,000 customers of the Coinbase exchange, although the flaw was subsequently fixed and Coinbase reimbursed affected customers. Similarly, in November 2022, hackers exploited weaknesses in the security architecture of the FTX Trading digital asset exchange and reportedly stole over $400 million in digital assets from customers. A successful security breach or cyberattack could result in:

Read in the 10-K filed Dec 11, 2025 ↗

Further, any actual or perceived data security breach or cybersecurity attack directed at other companies with digital assets or companies that operate digital asset networks, regardless of whether we are directly impacted, could lead to a general loss of confidence in the broader Solana ecosystem or in the use of the Solana network to conduct financial transactions, which could negatively impact us.

Read in the 10-K filed Dec 11, 2025 ↗

Attacks upon systems across a variety of industries, including industries related to Solana, are increasing in frequency, persistence, and sophistication, and, in many cases, are being conducted by sophisticated, well-organized groups and individuals, including state actors. The techniques used to obtain unauthorized, improper or illegal access to systems and information (including personal data and digital assets), disable or degrade services, or sabotage systems are constantly evolving, may be difficult to detect quickly, and often are not recognized or detected until after they have been launched against a target. These attacks may occur on our systems or those of our third-party service providers or partners. We may experience breaches of our security measures due to human error, malfeasance, insider threats, system errors or vulnerabilities or other irregularities. In particular, we expect that unauthorized parties will attempt to gain access to our systems and facilities, as well as those of our partners and third-party service providers, through various means, such as hacking, social engineering, phishing and fraud. Threats can come from a variety of sources, including criminal hackers, hacktivists, state intrusions, industrial espionage, and insiders. In addition, certain types of attacks could harm us even if our systems are left undisturbed. For example, certain threats are designed to remain dormant or undetectable, sometimes for extended periods of time, or until launched against a target and we may not be able to implement adequate preventative measures. The risk of cyberattacks could also be increased by cyberwarfare in connection with the ongoing Russia and Israel conflicts, or other future conflicts, including potential proliferation of malware into systems unrelated to such conflicts. Any future breach of our operations or those of others in the Solana industry, including third-party services on which we rely, could materially and adversely affect our financial condition and results of operations.

Read in the 10-K filed Dec 11, 2025 ↗

Digital asset lending arrangements may expose us to risks of borrower default, operational failures and cybersecurity threats.

Read in the 10-K filed Mar 31, 2026 ↗

Additionally, digital asset lending platforms are vulnerable to operational and cybersecurity risks. Technical failures, software bugs or system outages could disrupt lending activities, delay transactions or result in inaccurate record-keeping. Cybersecurity threats, including hacking, phishing and other malicious attacks, pose further risks, potentially leading to the loss, theft or misappropriation of our loaned digital asset. A successful cyberattack or security breach could materially and adversely impact our financial position, reputation and ability to conduct future lending activities.

Read in the 10-K filed Mar 31, 2026 ↗

Decentralized finance arrangements and smart contract-based protocols expose us to risks of asset loss, operational failure, and cybersecurity vulnerabilities.

Read in the 10-K filed Mar 31, 2026 ↗

The SEC has also brought recent actions against individuals and digital asset market participants alleging that such persons artificially increased trading volumes in certain digital assets through wash trades, or repeated buying and selling of the same assets in fictitious transactions to manipulate their underlying trading price. Such reports and allegations may indicate that the Solana market is significantly smaller than expected and that the United States makes up a significantly larger percentage of the Solana market than is commonly understood. Any actual or perceived wash trading in the Solana market, and any other fraudulent or manipulative acts and practices, could adversely affect the value of our Solana. Negative perception, a lack of stability in the broader Solana markets and the closure, temporary shutdown or operational disruption of Solana trading venues, lending institutions, institutional investors, institutional miners, custodians, or other major participants in the Solana ecosystem, due to fraud, business failure, cybersecurity events, government-mandated regulation, bankruptcy, or for any other reason, may result in a decline in confidence in Solana and the broader Solana ecosystem and greater volatility in the price of Solana. As the price of our listed securities is affected by the value of our Solana holdings, the failure of a major participant in the Solana ecosystem could have a material adverse effect on the market price of our listed securities.

Read in the 10-K filed Mar 31, 2026 ↗

Solana tokens are controllable only by the possessor of both the unique public key and private key(s) relating to the local or online digital wallet in which the Solana is held. While the Solana blockchain ledger requires a public key relating to a digital wallet to be published when used in a transaction, private keys must be safeguarded and kept private in order to prevent a third party from accessing the Solana held in such wallet. To the extent the private key(s) for a digital wallet are lost, destroyed, accessed by an unauthorized party, or otherwise compromised and no backup of the private key(s) is accessible, neither we nor our custodians will be able to access the Solana held in the related digital wallet. Furthermore, we cannot provide assurance that our digital wallets, nor the digital wallets of our custodians held on our behalf, will not be compromised as a result of a cyberattack. The Solana and blockchain ledger, as well as other digital assets and

Read in the 10-K filed Mar 31, 2026 ↗

blockchain technologies, have been, and may in the future be, subject to security breaches, cyberattacks, or other malicious activities. For more information on cybersecurity threats, please see the risk factor titled, “If we or the third parties with whom we work experience a security breach, cyber incident, or vulnerability impacting our systems or our data, or if unauthorized parties obtain access to our Solana, or if our private keys are lost or destroyed, or other similar circumstances or events occur, we may lose some or all of our Solana and our financial condition and results of operations could be materially adversely affected.”

Read in the 10-K filed Mar 31, 2026 ↗

If we or the third parties with whom we work experience a security breach, cyber incident, or vulnerability impacting our systems or our data, or if unauthorized parties obtain access to our Solana, or if our private keys are lost or destroyed, or other similar circumstances or events occur, we may lose some or all of our Solana and our financial condition and results of operations could be materially adversely affected.

Read in the 10-K filed Mar 31, 2026 ↗

trade secrets and our Solana (collectively, sensitive information). Cyber-attacks, malicious internet-based activity, online and offline fraud, and other similar activities threaten the confidentiality, integrity, and availability of our sensitive information and information technology systems, and those of the third parties with whom we work. Such threats are prevalent and continue to rise, are increasingly difficult to detect, and come from a variety of sources, including traditional computer “hackers,” threat actors, “hacktivists,” organized criminal threat actors, personnel (such as through theft or misuse), sophisticated nation states, and nation-state-supported actors. Some actors now engage and are expected to continue to engage in cyber-attacks, including without limitation nation-state actors for geopolitical reasons and in conjunction with military conflicts and defense activities. During times of war and other major conflicts, we, the third parties with whom we work, and our customers may be vulnerable to a heightened risk of these attacks, including retaliatory cyber-attacks, that could materially disrupt our business.

Read in the 10-K filed Mar 31, 2026 ↗

We and the third parties with whom we work are subject to a variety of evolving threats, including but not limited to social-engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), denial-of-service attacks, credential stuffing attacks, credential harvesting, personnel misconduct or error, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, software or hardware failures, loss of data or other information technology assets, adware, telecommunications failures, earthquakes, fires, floods, attacks enhanced or facilitated by AI, and other similar threats. In particular, severe ransomware attacks are becoming increasingly prevalent — particularly for companies like ours that are engaged in critical infrastructure or manufacturing — and can lead to significant interruptions in our operations, ability to provide our products or services, loss of sensitive data and income, reputational harm, and diversion of and theft of funds. Extortion payments may alleviate the negative impact of a ransomware attack, but we may be unwilling or unable to make such payments due to, for example, applicable laws or regulations prohibiting such payments. Remote work has increased risks to our information technology systems and data, as our employees utilize network connections, computers and devices outside our premises or network, including working at home, while in transit and in public locations.

Read in the 10-K filed Mar 31, 2026 ↗

investigation costs, regulatory penalties and fines, and legal proceedings. Our insurance coverage may not be adequate to cover all the costs related to such cybersecurity incidents.

Read in the 10-K filed Mar 31, 2026 ↗

Security breaches and cyberattacks are of particular concern with respect to our Solana. Solana and other blockchain-based cryptocurrencies and the entities that provide services to participants in the Solana ecosystem have been, and may in the future be, subject to security breaches, cyberattacks, or other malicious activities. For example, in October 2021 it was reported that hackers exploited a flaw in the account recovery process and stole from the accounts of at least 6,000 customers of the Coinbase exchange, although the flaw was subsequently fixed and Coinbase reimbursed affected customers. Similarly, in November 2022, hackers exploited weaknesses in the security architecture of the FTX Trading digital asset exchange and reportedly stole over $400 million in digital assets from customers. A successful security breach or cyberattack could result in:

Read in the 10-K filed Mar 31, 2026 ↗

Further, any actual or perceived data security breach or cybersecurity attack directed at other companies with digital assets or companies that operate digital asset networks, regardless of whether we are directly impacted, could lead to a general loss of confidence in the broader Solana ecosystem or in the use of the Solana network to conduct financial transactions, which could negatively impact the market price of Solana and in turn negatively impact our financial condition and results of operations and the market price of our common stock.

Read in the 10-K filed Mar 31, 2026 ↗

Tokenized HSDT would also be subject to the broader risks associated with digital assets, including cybersecurity, technological failures, and operational risks, which could affect our reputation, financial condition, and operating results. As of March 30, 2026, the Company has not issued Tokenized HSDT.

Read in the 10-K filed Mar 31, 2026 ↗

In the United States, federal, state, and local governments have enacted numerous data privacy and security laws, including data breach notification laws, personal data privacy laws, consumer protection laws (e.g., Section 5 of the Federal Trade Commission Act) and other similar laws (e.g., wiretapping laws). For example, the federal Health Insurance Portability and Accountability Act of 1996 (“HIPAA”), as amended by the Health Information Technology for Economic and Clinical Health Act (“HITECH”), and their respective implementing regulations, imposes requirements relating to the privacy, security and transmission of individually identifiable health information. Among other things, HITECH, through its implementing regulations, makes certain of HIPAA’s privacy and security standards directly applicable to business associates, defined as a person or organization, other than a member of a covered entity’s workforce, that creates, receives, maintains or transmits protected health information for or on behalf of a covered entity for a function or activity regulated by HIPAA as well as their covered subcontractors.

Read in the 10-K filed Mar 31, 2026 ↗

physical and cybersecurity breaches, including security breaches of infrastructure;

Read in the 10-K filed Feb 25, 2026 ↗

Recent developments in the cyber threat landscape include use of AI and machine learning, as well as an increased number of cyber extortion and ransomware attacks, with the potential for higher ransom demand amounts and increasing sophistication, using a variety of ransomware techniques and methodology. Further, any adoption of AI by us or by third parties may pose new security challenges. A party who is able to compromise the security measures on our networks or the security of our infrastructure could misappropriate the proprietary or sensitive information of us, our customers, or our employees, or cause interruptions or malfunctions in our operations or our customers’ operations.

Read in the 10-K filed Feb 25, 2026 ↗

In addition to Bitcoin, we have acquired 100 million World Liberty Financial, Inc. tokens (the “WLFI Tokens”), which are subject to many of the same risks applicable to Bitcoin and other digital assets, including price volatility, limited liquidity, regulatory uncertainty, technological risks, cybersecurity risks, and changes in market sentiment. Unlike Bitcoin, our WLFI Tokens are subject to an indefinite lock-up, with a minimum of twelve months from the purchase date, and may not be freely transferable. The WLFI Tokens are also subject to the governance procedures of the World Liberty Financial, Inc. protocol, which may be amended or administered in the discretion of World Liberty Financial, Inc. or its affiliates. As a result, we may have limited ability to influence decisions affecting the WLFI Tokens or its underlying protocol, and the value, utility, or transferability of the WLFI Tokens could be adversely affected by governance actions or other decisions beyond our control.

Read in the 10-K filed Feb 25, 2026 ↗

The price of HYPE has exhibited sudden and significant fluctuations due to shifts in market sentiment, speculative trading, macroeconomic trends, technology-related disruptions and regulatory announcements. Because digital asset trading markets are relatively new, largely unregulated and, at times, subject to limited liquidity, HYPE has experienced and may continue to experience larger or more frequent price swings than traditional asset classes. A rapid decrease in the price of HYPE - whether the result of negative perception, a lack of stability on the digital asset trading platforms on which HYPE trades, market manipulation of cryptocurrency trading platforms by customers, a cyber-security incident, regulatory action or other factors-could materially reduce the value of any HYPE we hold, force us to recognize impairment charges, and depress the market price of our securities.

Read in the 10-K filed Mar 30, 2026 ↗

HYPE is controllable only by the possessor of both the unique public key and private key(s) relating to the local or online digital wallet in which the HYPE is held. While the Layer 1 blockchain ledger requires a public key relating to a digital wallet to be published when used in a transaction, private keys must be safeguarded and kept private in order to prevent a third party from accessing the HYPE held in such wallet. To the extent the private key(s) for a digital wallet are lost, destroyed, or otherwise compromised and no backup of the private key(s) is accessible, neither we nor our custody infrastructure providers will be able to access the HYPE held in the related digital wallet. Furthermore, we cannot provide assurance that our digital wallets, nor the digital wallets of our custody infrastructure providers, will not be compromised as a result of a cyberattack. The HYPE and blockchain ledger, as well as other digital assets and blockchain technologies, have been, and may in the future be, subject to security breaches, cyberattacks or other malicious activities.

Read in the 10-K filed Mar 30, 2026 ↗

Negative perception, a lack of stability in the broader digital currency markets and the closure, temporary shutdown or operational disruption of HYPE trading venues, lending institutions, institutional investors, institutional miners, custodians, or other major participants in the HYPE ecosystem, due to fraud, business failure, cybersecurity events, government-mandated regulation, bankruptcy or any other reason, may result in a decline in confidence in HYPE and the broader digital currency ecosystem and greater volatility in the price of HYPE. For example, in 2022, each of Celsius Network, Voyager Digital, Three Arrows Capital, FTX and BlockFi filed for bankruptcy, following which digital assets significantly declined. In addition, in June 2023, the SEC announced enforcement actions against Coinbase and Binance, two providers of large trading venues for digital assets, which similarly was followed by a decrease in the market price of digital assets. These were followed in November 2023 by an SEC enforcement action against Payward Inc. and Payward Ventures Inc., together known as Kraken, another large trading venue for digital assets. While the complaint against Coinbase was dismissed in February 2025, the complaint against Payward Inc. and Payward Ventures Inc. was dismissed with prejudice in March 2025, and the complaint against Binance was dismissed in May 2025, the SEC or other regulatory agencies may initiate similar actions in the future. As the price of our listed securities may be affected by the value of our HYPE holdings, the failure of a major participant in the digital currency ecosystem could have a material adverse effect on the market price of our listed securities.

Read in the 10-K filed Mar 30, 2026 ↗

The secure processing, storage, maintenance and transmission of this critical information is vital to our operations and business strategy, and we devote significant resources to protecting such information. Although we take measures to protect sensitive information from unauthorized access or disclosure, our information technology and infrastructure may be vulnerable to attacks by hackers or viruses, breaches, interruptions due to employee error, malfeasance, faulty password management, lapses in compliance with privacy and

Read in the 10-K filed Mar 30, 2026 ↗

Bitcoin trading venues operate under varying regulatory regimes, and in some jurisdictions may be subject to limited oversight, inconsistent disclosure requirements or evolving regulatory standards. Governance, transparency, internal controls and risk management practices differ significantly across trading platforms. As a result, confidence in bitcoin markets could decline if prominent exchanges experience fraud, insolvency, cybersecurity incidents, operational failures or government-imposed restrictions.

Read in the 10-K filed Mar 2, 2026 ↗

Abandonment of Established Revenue Streams: By exiting our healthcare business, we are moving away from industry-specific revenue streams that provided a degree of predictability. Our future financial performance will now be primarily driven by the market price of Bitcoin, which is notoriously volatile and subject to factors entirely outside our control, and the performance of our Bitcoin-related operations, which may also be positively or negatively impacted by the price of Bitcoin. Legacy Liabilities: Despite our pivot, we may be subject to potential “tail” liabilities related to our former healthcare operations, including potential medical malpractice claims, HIPAA data breach liabilities, or clinical trial disputes. The costs associated with defending or settling these legacy claims could diminish the cash reserves we intend to allocate toward our Bitcoin strategy. Investor Base Misalignment: Investors who purchased our stock for exposure to the healthcare sector may sell their shares as a result of this strategy shift, leading to increased downward pressure on our Common Stock price and heightened volatility during the transition period. Execution Risk: We may be unable to successfully divest or liquidate our remaining healthcare assets at favorable valuations, which could limit our ability to execute our Bitcoin acquisition targets on our planned timeline.

Read in the 10-K filed Mar 30, 2026 ↗

Insurance coverage for digital assets is limited and may not be available on commercially reasonable terms. The insurance market for digital asset risks is undeveloped, and insurers may be unwilling to provide coverage for theft, hacking, or fraud. Our Bitcoin strategy may increase costs or limit availability of directors and officers (“D&O”) insurance, errors and omissions (“E&O”) insurance, and cyber liability insurance. If we are unable to obtain adequate coverage, we could be exposed to significant uninsured losses. Additionally, successful execution of our strategy depends on attracting and retaining personnel with specialized expertise in digital assets, blockchain technology, and cryptocurrency custody. The market for such expertise is highly competitive, and if we are unable to attract, retain, or develop qualified personnel, our ability to manage holdings and respond to security threats could be materially impaired.

Read in the 10-K filed Mar 30, 2026 ↗

Our digital ticketing and data-driven advertising operations are vulnerable to sophisticated cyber-attacks and network failures.

Read in the 10-K filed Mar 30, 2026 ↗

Cybersecurity incidents or Security Incidents affecting our investment advisory operations could result in the loss, unavailability, destruction, alteration, prevention of access to, disclosure, or dissemination of, or damage or unauthorized access to client assets or confidential information, and we could experience material adverse consequences resulting from such compromise, including but not limited to regulatory investigations or actions, litigation (including class actions and mass arbitration), fines and penalties, disruptions of our business operations, loss of revenue or profits, and reputational harm.

Read in the 10-K filed Mar 30, 2026 ↗

Our investment advisory operations depend on our and our third-party service providers’ information technology systems to manage client accounts, execute trades, maintain records, and communicate with clients and counterparties. These systems contain sensitive client information, including personal financial data, investment holdings, and transaction histories. Cybersecurity incidents, including hacking, phishing, ransomware, and other attacks, could compromise the confidentiality, integrity, or availability of our systems and data. A successful cybersecurity incident or other Security Incident could result in unauthorized access to client accounts, theft of client assets (including digital assets), disclosure of confidential client information, and disruption of our advisory operations. The SEC has issued guidance emphasizing investment advisers’ obligations to adopt cybersecurity policies and procedures, and has brought enforcement actions against advisers for cybersecurity failures. Additionally, we may be subject to state data breach notification laws and other data protection requirements. Any significant cybersecurity or other Security Incident could result in client losses, regulatory enforcement actions, litigation, notification costs, remediation expenses, and severe reputational damage, which could have a material adverse effect on our advisory business and client relationships.

Read in the 10-K filed Mar 30, 2026 ↗

Risks Related to Cybersecurity, Information Technology, and Intellectual Property

Read in the 10-K filed Mar 30, 2026 ↗

Security Incidents, malicious internet-based activity, online and offline fraud, and other similar activities threaten the confidentiality, integrity, and availability of our and our customers’ data and information technology systems, and those of the third parties with whom we work. Security Incidents are increasing in frequency, persistence, and sophistication, conducted by criminal hackers, hacktivists, state-sponsored actors, and insiders using techniques such as hacking, social engineering, phishing, ransomware, and advanced persistent threats. These incidents may target our systems, our third-party service providers, or partners and can affect our ability to operate effectively and the integrity and continued availability of our information systems, data, and services. We may experience Security Incidents due to human error, malfeasance, insider threats, or system vulnerabilities. The risk of Security Incidents has been heightened by remote and hybrid working arrangements, as more of our employees utilize network connections, computers, and devices outside our premises or network, including while working at home, while in transit, or in public locations. Any breach of our operations or those of others in the Bitcoin industry could materially and adversely affect our business.

Read in the 10-K filed Mar 30, 2026 ↗

We and the third parties with whom we work are subject to a variety of evolving Security Incident threats, including but not limited to social-engineering attacks (including through deep fakes, which may be increasingly more difficult to identify as fake, and phishing attacks), malicious code (such as viruses and worms), malware (including as a result of advanced persistent threat intrusions), credential harvesting, personnel misconduct or error, ransomware attacks, supply-chain attacks, software bugs, server malfunctions, or hardware failures, loss of data or other information technology assets, adware, attacks enhanced or facilitated by artificial intelligence (“AI”), including through increased speed, scale, or sophistication, telecommunications failures, earthquakes, fire, flood, power loss, system failures, computer viruses, software errors, physical or electronic break-ins or malicious hacks or attacks on our systems (such as denial of service attacks), and other similar threats. Additionally, our confidential and sensitive data of the Company and our clients may be leaked, disclosed, or revealed as a result of or in connection with our employees’, personnel’s, or vendors’ use of AI technology.

Read in the 10-K filed Mar 30, 2026 ↗

The proper functioning of our information technology infrastructure is critical to the efficient operation of our business. Our IT systems are vulnerable to Security Incidents, viruses, malware, ransomware, physical and electronic break-ins, and similar disruptions. We also outsource certain IT infrastructure to third parties, including cloud-based services, encryption and authentication technology, employee email, content delivery to clients, and other functions, which introduces additional cybersecurity risks. In some cases, our operations may depend on the continued availability and performance of these third-party services. We may not have the financial resources to update and maintain our IT infrastructure, and any failure could adversely impact operations. In addition, our ability to monitor these third parties’ information security practices is limited, and these third parties may not have adequate information security measures in place. Unauthorized acquisition, access, use or disclosure involving unsecured PHI could result in significant notification and remediation costs, as well as HIPAA violations and significant fines. Failure of IT systems could delay billing, disrupt operations, compromise confidential information, and result in financial losses, litigation, regulatory enforcement, and reputational harm.

Read in the 10-K filed Mar 30, 2026 ↗

In the ordinary course of business, we collect, receive, store, process, generate, use, transfer, disclose, and otherwise handle personal data and other sensitive information, including PHI in connection with aspects of our healthcare operations. Our privacy and data security obligations include numerous federal, state, and foreign data privacy and security laws, including data breach notification laws, consumer protection laws, and comprehensive state privacy laws. These laws impose obligations including specific privacy notice disclosures, data subject rights (such as access, correction, and deletion rights), opt-out mechanisms for targeted advertising and profiling, and requirements for data privacy impact assessments. Complying with these obligations requires us to devote significant resources, which may necessitate changes to our services, information technologies, systems, and practices and to those of any third parties that process sensitive data on our behalf.

Read in the 10-K filed Mar 30, 2026 ↗

Certain natural disasters, mechanical failures, cyber incidents, evolving climate and ESG requirements, and other events outside of our control could adversely affect us.

Read in the 10-K filed Mar 2, 2026 ↗

The demand for power to support data centers, including AI/HPC workloads, has increased significantly, and we believe that by allocating a portion of our available power capacity to AI/HPC customers, while continuing to operate our bitcoin mining business, may create long-term value for our stockholders. We are in the process of developing scalable data center platforms at our Corsicana Facility and Rockdale Facility. As we pursue this expansion, we may face reputational harm, liability exposure, and adverse financial impacts arising from perceptions that we are shifting away from our core bitcoin-mining business, challenges associated with execution or integration, or increased scrutiny from investors and participants in the broader digital asset industry. Any perception that we are deprioritizing bitcoin mining could adversely affect our relationships with certain stakeholders, including investors, employees, and members of the crypto community. Data center customers also generally have heightened expectations regarding uptime, data integrity, cybersecurity, sustainability, and operational reliability. Any failure to meet these expectations, or any adverse incident involving our data center operations, could damage our reputation and credibility and negatively affect customer relationships. If we are unable to maintain or enhance our reputation, successfully execute our data-center strategy, or adapt to

Read in the 10-K filed Mar 2, 2026 ↗

Certain natural disasters, external events, mechanical failures, cyber incidents, and evolving climate, energy and Environmental, Social and Governance (“ESG”) requirements could adversely affect our business, financial condition, results of operations, cash flows, and prospects.

Read in the 10-K filed Mar 2, 2026 ↗

We have deployed ETH using one or more decentralized finance protocols. All trading and investment activity involves risk, which is heightened in the case of decentralized finance due to the irrevocable nature of blockchain transactions and the possibility of errors in smart contracts. Decentralized finance protocols also attract hackers and persons looking to exploit flaws in or the ability to misuse smart contracts. We also may incur losses in connection with our decentralized finance activity due to human error or our inability to predict future price movements. Any losses we sustain in connection with decentralized finance activities could cause an adverse impact on our financial condition, results of operations, and the market price of our Common Stock.

Read in the 10-K filed Mar 9, 2026 ↗

If we or our third-party service providers experience a security breach or cyberattack and unauthorized parties obtain access to our ETH, or if our private keys are lost or destroyed, or other similar circumstances or events occur, we may lose some or all of our ETH and our financial condition and results of operations could be materially adversely affected.

Read in the 10-K filed Mar 9, 2026 ↗

All of the ETH and ETH-related digital assets we own is held in custody accounts at institutional-grade digital asset custodians. Security breaches and cyberattacks are of particular concern with respect to our ETH and ETH-related digital assets. ETH and other blockchain-based cryptocurrencies and the entities that provide services to participants in the ETH ecosystem have been, and may in the future be, subject to security breaches, cyberattacks, or other malicious activities. A successful security breach or cyberattack could result in:

Read in the 10-K filed Mar 9, 2026 ↗

Further, any actual or perceived data security breach or cybersecurity attack directed at other companies with digital assets or companies that operate digital asset networks, regardless of whether we are directly impacted, could lead to a general loss of confidence in the broader blockchain ecosystem or in the use of the Ethereum network to conduct financial transactions, which could negatively impact us.

Read in the 10-K filed Mar 9, 2026 ↗

Attacks upon systems across a variety of industries, including industries related to ETH, are increasing in frequency, persistence, and sophistication, and, in many cases, are being conducted by sophisticated, well-funded and organized groups and individuals, including state actors. The techniques used to obtain unauthorized, improper or illegal access to systems and information (including personal data and digital assets), disable or degrade services, or sabotage systems are constantly evolving, may be difficult to detect quickly, and often are not recognized or detected until after they have been launched against a target. These attacks may occur on our systems or those of our third-party service providers or partners. We may experience breaches of our security measures due to human error, malfeasance, insider threats, system errors or vulnerabilities or other irregularities. Threats can come from a variety of sources, including criminal hackers, hacktivists, state-sponsored intrusions, industrial espionage, and insiders. In addition, certain types of attacks could harm us even if our systems are left undisturbed. For example, certain threats are designed to remain dormant or undetectable, sometimes for extended periods of time, or until launched against a target and we may not be able to implement adequate preventative measures. The risk of cyberattacks could also be increased by cyberwarfare in connection with the ongoing Russia-Ukraine and Israel-Hamas conflicts, or other future conflicts, including potential proliferation of malware into systems unrelated to such conflicts. Any future breach of our operations or those of others in the ETH industry, including third-party services on which we rely, could materially and adversely affect our business.

Read in the 10-K filed Mar 9, 2026 ↗

Cybersecurity incidents and other issues related to our information systems, technology and data may affect us materially and adversely.

Read in the 10-K filed Mar 9, 2026 ↗

Cybersecurity incidents and cyberattacks have been occurring globally at a more frequent and severe level and will likely continue to increase in frequency in the future. The digital asset industry is a particular target for cybersecurity incidents, which may occur through intentional or unintentional acts by individuals or groups having authorized or unauthorized access to our systems or our clients’ or counterparties’ information, which may include confidential information. These individuals or groups include employees, vendors and customers, as well as hackers. The information and technology systems used by us and our service providers, and other third parties, are vulnerable to damage or interruption from, among other things: hacking, ransomware, malware and other computer viruses; denial of service attacks; network failures; computer and telecommunication failures; phishing attacks; infiltration by unauthorized persons; security breaches; usage errors by their respective professionals; power outages; terrorism; and catastrophic events such as fires, tornadoes, floods, hurricanes and earthquakes. It is difficult or impossible to defend against every risk being posed by changing technologies, as well as criminals’ intent to commit cybercrime, and these efforts may not be successful in anticipating, preventing, detecting or stopping attacks, or reacting in a timely manner. The increasing sophistication and resources of cybercriminals and other non-state threat actors and increased actions by nation-state actors make it difficult to keep up with new threats and could result in a breach of security. Such threats may see their frequency increased, and effectiveness enhanced, by the use of artificial intelligence. Further, cybersecurity risks may be heightened as a result of ongoing global conflicts such as the Russia-Ukraine conflict or the ongoing Israel-Hamas conflict. Additionally, we cannot guarantee that our insurance coverage would be sufficient to cover any such losses.

Read in the 10-K filed Mar 9, 2026 ↗

To the extent the operation of our systems relies on our third-party service providers, through either a connection to, or an integration with, third parties’ systems, the risk of cybersecurity attacks and loss, corruption, or unauthorized access to or publication of our information or the confidential information and personal data of customers and employees may increase. Third-party risks may include insufficient security measures, data location uncertainty, and the possibility of data storage in inappropriate jurisdictions where laws, security measures or other controls may be inadequate or in which there are uncertainties regarding governmental intervention and use of such data, and our ability to monitor our third-party service providers’ data security practices are limited. Although we generally have agreements relating to cybersecurity and data privacy in place with our third-party service providers, they are limited in nature and we cannot guarantee that such agreements will prevent the accidental or unauthorized access to or disclosure, loss, destruction, disablement or encryption of, use or misuse of or modification of data (including personal data) or enable us to obtain adequate or any reimbursement from our third-party service providers in the event we should suffer any such incidents. Due to applicable laws and regulations or contractual obligations, we may be held responsible for any information security failure or cybersecurity attack attributed to our vendors as they relate to the information we share with them. A vulnerability in or related to a third-party service provider’s software or systems, a failure of our third-party service providers’ safeguards, policies or procedures, or a breach of a third-party service provider’s software or systems could result in the compromise of the confidentiality, integrity or availability of our systems or the data housed in our third-party solutions.

Read in the 10-K filed Mar 9, 2026 ↗

The security of the information and technology systems used by us and our service providers may continue to be subjected to cybersecurity threats that could result in material failures or disruptions in our business. If these systems are compromised, become inoperable for extended periods of time or cease to function properly, we or a service provider may have to make a significant investment to fix or replace them. The failure of these systems or of disaster recovery plans for any reason could cause significant interruptions in operations and result in a failure to maintain the security, confidentiality or privacy of sensitive data, including personal information relating to stockholders (and the beneficial owners of stockholders). Such a failure could harm our reputation, subject us to legal claims and otherwise materially and adversely affect our investment and trading strategies and our value.

Read in the 10-K filed Mar 9, 2026 ↗

ETH and ETH-related digital assets are controllable only by the possessor of both the unique public key and private key(s) relating to the local or online digital wallet in which the ETH and ETH-related digital assets are held. While the ETH blockchain ledger requires a public key relating to a digital wallet to be published when used in a transaction, private keys must be safeguarded and kept private in order to prevent a third party from accessing the ETH and ETH-related digital assets held in such wallet. To the extent the private key(s) for a digital wallet are lost, destroyed, or otherwise compromised and no backup of the private key(s) is accessible, neither we nor our custodians will be able to access the ETH and ETH-related digital assets held in the related digital wallet. Furthermore, we cannot provide assurance that our digital wallets, nor the digital wallets of our custodians held on our behalf, will not be compromised as a result of a cyberattack. ETH, as well as other digital assets and blockchain technologies, have been, and may in the future be, subject to security breaches, cyberattacks, or other malicious activities.

Read in the 10-K filed Mar 9, 2026 ↗

The security and accessibility of our SUI assets are, in part, dependent on the integrity and reliability of the cryptocurrency custodians and exchanges used to hold, trade, or manage SUI. We currently utilize BitGo as custodian to hold all of our SUI assets. BitGo is a digital asset security firm established in 2013. Many cryptocurrency custodians, including BitGo, are relatively new and unregulated, and may be subject to internal control failures, including inadequate cybersecurity measures, poor risk management practices, or operational errors. Such failures can lead to asset loss, theft, suspension or freezing of accounts, delays in executing trades, or compromised private information. If a custodian or exchange we utilize to hold our SUI experiences an internal control failure, we may suffer partial or total loss of our SUI holdings, incur financial losses, experience disruptions in liquidity, or face reputational harm. Further, the regulatory environment relating to internal controls at cryptocurrency custodians and exchanges remains uncertain and fragmented, increasing the risk of internal control failures. There can be no assurance that our SUI assets will not be affected by such incidents, and the occurrence of internal control failures could materially adversely impact our financial condition and results of operations.

Read in the 10-K filed Feb 27, 2026 ↗

If we or our third-party service providers experience a security breach or cyberattack and unauthorized parties obtain access to our SUI, or if our private keys are lost or destroyed, or other similar circumstances or events occur, we may lose some or all of our SUI and our financial condition and results of operations could be materially adversely affected.

Read in the 10-K filed Feb 27, 2026 ↗

Substantially all of the SUI we own is held in custody accounts at BitGo, a well-known custodian. Security breaches and cyberattacks are of particular concern with respect to our SUI. SUI and other blockchain-based cryptocurrencies and the entities that provide services to participants in the SUI ecosystem have been, and may in the future be, subject to security breaches, cyberattacks, or other malicious activities. For example, in October 2021 it was reported that hackers exploited a flaw in the account recovery process and stole from the accounts of at least 6,000 customers of the Coinbase exchange, although the flaw was subsequently fixed and Coinbase reimbursed affected customers. Similarly, in November 2022, hackers exploited weaknesses in the security architecture of the FTX Trading digital asset exchange and reportedly stole over $400 million in digital assets from customers. A successful security breach or cyberattack could result in:

Read in the 10-K filed Feb 27, 2026 ↗

Further, any actual or perceived data security breach or cybersecurity attack directed at other companies with digital assets or companies that operate digital asset networks, regardless of whether we are directly impacted, could lead to a general loss of confidence in the broader Sui ecosystem or in the use of the Sui network to conduct financial transactions, which could negatively impact us.

Read in the 10-K filed Feb 27, 2026 ↗

Attacks upon systems across a variety of industries, including industries related to SUI, are increasing in frequency, persistence, and sophistication, and, in many cases, are being conducted by sophisticated, well-funded and organized groups and individuals, including state actors. The techniques used to obtain unauthorized, improper or illegal access to systems and information (including personal data and digital assets), disable or degrade services, or sabotage systems are constantly evolving, may be difficult to detect quickly, and often are not recognized or detected until after they have been launched against a target. These attacks may occur on our systems or those of our third-party service providers or partners. We may experience breaches of our security measures due to human error, malfeasance, insider threats, system errors or vulnerabilities or other irregularities. In particular, we expect that unauthorized parties will attempt to gain access to our systems and facilities, as well as those of our partners and third-party service providers, through various means, such as hacking, social engineering, phishing and fraud. Threats can come from a variety of sources, including criminal hackers, hacktivists, state-sponsored intrusions, industrial espionage, and insiders. In addition, certain types of attacks could harm us even if our systems are left undisturbed. For example, certain threats are designed to remain dormant or undetectable, sometimes for extended periods of time, or until launched against a target and we may not be able to implement adequate preventative measures. Further, there has been an increase in such activities due to the increase in work-from-home arrangements. The risk of cyberattacks could also be increased by cyberwarfare in connection with the ongoing Russia-Ukraine and Israel-Hamas conflicts, or other future conflicts, including potential proliferation of malware into systems unrelated to such conflicts. Any future breach of our operations or those of others in the Sui industry, including third-party services on which we rely, could materially adversely affect our financial condition and results of operations.

Read in the 10-K filed Feb 27, 2026 ↗

We may use generative artificial intelligence and/or machine learning (collectively, “AI”) tools in our operations. If our peers use AI tools to optimize operations and we fail to utilize AI tools in a comparable manner, we may be competitively disadvantaged. However, while AI tools may facilitate optimization and operational efficiencies, they also have the potential for inaccuracy, bias, infringement or misappropriation of intellectual property, and risks related to data privacy and cybersecurity. The use of AI tools may introduce errors or inadequacies that are not easily detectable, including deficiencies, inaccuracies or biases in the data used for AI training, or in the content, analyses or recommendations generated by AI applications. The results of such errors or inadequacies may adversely affect our business, financial condition and results of operations. The legal requirements relating to AI continue to evolve and remain uncertain, including how legal developments could impact our business and ability to enforce our proprietary rights or protect against infringement of those rights. Cybersecurity threat actors may utilize AI tools to automate and enhance cybersecurity attacks against us. The integration of AI tools in the digital asset industry may present significant opportunities and risks for our vendors, investors or contract counterparties, similar to those risks described above.

Read in the 10-K filed Feb 27, 2026 ↗

Any disruptions or failures of our systems or other services that we use, including as a result of a natural disaster, fire, cyberattack (including the potential increase in risk for such attacks due to cyberwarfare in connection with the ongoing Russia-Ukraine and Israel-Hamas conflicts), act of terrorism, geopolitical conflict (including due to the ongoing Russia-Ukraine, Israel-Hamas and U.S.-Venezuela conflicts and any potential conflict involving China and Taiwan), pandemic, the effects of climate change, or other catastrophic event, as well as power outages, telecommunications infrastructure outages, a decision by one of our third-party service providers to materially change the pricing or terms of their services, or other unanticipated problems with our third-party services that we use, such as a failure to meet service standards, could severely impact our ability to conduct our business operations, or result in a material weakness in our internal control over financial reporting, any of which could materially adversely affect our future operating results.

Read in the 10-K filed Feb 27, 2026 ↗