Bulgaria issues first MiCA licences as Sofia positions itself as EU crypto hub

Bulgaria has issued its first MiCA licences, with the Financial Supervision Commission licensing five crypto asset service providers since the transitional period ended on 1 July 214. The regulator stressed that "MiCA is a task of business maturity" and that licensing is only the beginning of ongoing supervision 14. One of the first licensees, an investment firm dating back to 2011, said the main challenge was "meeting all the requirements within very strict time frames" because some MiCA deadlines cannot be changed 2.

The role of AI in security was a dominant thread. A panel on AI and Web3 security argued that "hacks have always been kind of a hot topic of the web 3 space" and that AI is now central to both attack and defence 1. In a separate talk, Krum Pashov of Pashov Audit Group noted that bug bounties remain a viable path for security researchers, citing one researcher who earned over $300,000 in three months 5. He urged: "When others are lazy, do the work." Another talk warned that AI agents themselves can become insiders, as they "never gets tired, it never sleeps, and it actually has access to your entire machine" 10.

The Ethereum Foundation introduced the CROPS framework – censorship resistance, open source, privacy, security – and said its goal is to minimise its own role over time. A representative explained that "the more successful we are in passing that, the less Ethereum foundation needs has a role in Ethereum core development and maintenance" 6. Meanwhile, a fireside chat on How DeFi Lost the Plot argued that the industry witnessed "basically the death of all Dows" and is now redefining what token holders actually own 9.

On stablecoins, a talk declared "stablecoins have won" and noted that total circulating supply has passed $300 billion, with euro-denominated stablecoins seeing growing demand for B2B payments 13. A panel on euro stablecoins reported that one issuer processed €150 million in August 2026 and expects to close September north of €200 million 8. Tokenisation of real-world assets was another focus: Ethereum holds approximately $17 billion in tokenised RWAs, with daily transfer volume at $10.1 billion, up nearly 40% month-over-month 4.

Other key discussions covered cross-chain security, where a Chainlink Labs speaker called security "an economic concept" and warned that bridges can put the whole asset at risk 11; post-quantum threats, with a panel noting that "the biggest misconception … is that when you choose the best post-quantum secure algorithm and implement it, you're done" 7; and the need for local-first data sovereignty, with a Trezor engineer arguing that users should apply the "not your keys, not your coins" mindset to their data as well 12.

• MiCA Roadmap | Vasil Golemanski, Financial Supervision Commission 14 – the regulator's own assessment of Bulgaria's first licences and the road ahead.
• Security in the AI Age | Krum Pashov, Pashov Audit Group 5 – concrete advice on bug bounties and the state of Web3 security.
• How DeFi Lost the Plot 9 – a candid reflection on DAO governance and token holder rights.
• Stablecoins Have Won. Now What? | Maximilian Roszko, Curve Finance 13 – data-driven overview of the stablecoin market.
• The Custody Paradox: Security, Usability, and Who Gets to Verify 3 – a hardware wallet and stateless client panel on self-custody threats.