Strike security record

Strike Europe authorised under MiCA by the Maltese regulator

Zap (Strike) Europe Limited was authorised as a crypto asset service provider by the Malta Financial Services Authority under MiCA, EU Regulation 2023/1114, and Malta's Markets in Crypto Assets Act, Cap. 647, and Strike relocated its European headquarters from Poland to Malta. MiCA sets one standard for operating across the EU. Strike lists what it requires: customer assets segregated from the firm's own, bitcoin and cash balances held one to one, never lent out and never used to run the company, minimum capital and ongoing solvency testing, fit and proper checks on executives, and rules on best execution, order handling, custody, conflicts of interest and anti money laundering.

Strike blog

NYDFS granted Strike a BitLicense and a money transmitter licence

Zap Solutions, Inc. dba Strike announced that the New York State Department of Financial Services had granted it both a BitLicense and a money transmitter licence, completing its expansion to all 50 US states. Strike says the licences subject it to audits, capital reserve requirements and cybersecurity examinations, and that bitcoin and cash in a Strike account are held 1:1 and not lent out or used for corporate operations. Buying, selling, direct deposit conversion, target orders, recurring buys and bill pay opened to New York customers that day. Bitcoin backed loans and lines of credit followed on 2 April 2026.

Strike blog

Withdrawals can now be locked behind passkey or hardware key 2FA

Strike added passkeys and physical security keys as second factors alongside authenticator apps, and introduced protected actions, which let a customer require 2FA on specific activity rather than only at login. The list includes sends and withdrawals, covering both bitcoin and cash transactions, and account updates such as changing a phone number. Logging back in always requires 2FA once it is enabled, and Strike emails the account holder whenever 2FA or protected actions are enabled or disabled.

Strike blog

Europe opened on a Polish VASP registration, not an EU licence

Strike launched to eligible customers in Europe on 24 April 2024, announced by Jack Mallers the same day, offering bitcoin buying, selling, sending and withdrawal with free SEPA euro deposits. It did so through a Poland based virtual asset service provider entity, under the national registration regimes that preceded MiCA rather than an EU wide authorisation. Strike confirmed that arrangement in its own MiCA announcement two years later, when it moved the European entity to Malta.

Strike blog

Customer email list leaked, denied by Strike, then admitted

Strike customers began receiving phishing mail at addresses they had given to nobody but Strike. On 30 October 2023 Strike told The Block that its security team had been investigating the claims and that at the time there was no evidence Strike had been breached. Within minutes investigator ZachXBT published evidence of the leak, and within hours Strike emailed customers acknowledging that its email list had been taken, attributing the leak to a third party. What was exposed was registration email addresses, which were then used for phishing that impersonated other crypto brands including Etherscan and OpenSea. No loss of customer funds from the leak itself was reported.

Protos

Illinois biometric privacy class action filed by a customer

Candice Wilhelm filed a proposed class action against Zap Solutions, Inc. dba Strike in the Circuit Court of Cook County, Illinois, Chancery Division, case 2023-CH-08524, under section 15 of the Illinois Biometric Information Privacy Act, 740 ILCS 14/15. This was a private suit, not a regulator's action. Zap Solutions removed it to the Northern District of Illinois on 3 November 2023, where it was docketed as 1:23-cv-15630 before Judge Nancy L. Maldonado and terminated on 12 December 2023. The Cook County record shows the case as disposed. No public judgment against Strike has been reported, and the public docket does not state why the federal case ended.

Cook County complaint via Trellis

Strike brought custody of customer bitcoin and dollars in house

Jack Mallers announced that Strike had removed its custodial intermediaries and now custodies customer bitcoin itself, in multisig vaults with geographically distributed keys that are encrypted and backed up physically and digitally in separate locations, the majority in cold storage with a smaller hot wallet float for immediate transactions. Customer dollars moved to bank accounts held by Strike. The post says all bitcoin on Strike is backed 1:1 and discloses third party security assessments including SOC 2 certification and regular penetration testing. It does not say balances are never lent out; Strike published that claim later, in its 2026 New York and MiCA announcements.

Strike blog

Reported to hold a state money transmitter licence in only one state

Decrypt reported that Zap Solutions, which operates Strike, was serving customers everywhere in the United States except New York and Hawaii while holding a state money transmitter licence only in Washington. Lucinda Fazio, then director of consumer services at Washington's Department of Financial Institutions, told the outlet that one of the main tenets of the programme is that no company gets to do business in any state without that state's specific licence. Decrypt wrote that Strike and Jack Mallers had repeatedly ignored its requests for comment on what licences Strike held. Strike did not finish licensing every US state until March 2026.

Decrypt