Exodus Movement, Inc. Class A (EXOD) Risk Analysis

As a general matter, laws and regulations of digital assets, blockchain technologies and digital asset exchanges are currently undeveloped, vary among federal, state, local and international jurisdictions and are subject to significant uncertainty. Specifically, the laws and regulations governing un-hosted self-custody wallet providers like Exodus are currently undeveloped and many domestic and international laws and regulations that apply to digital assets, blockchain technologies and digital exchanges are not applicable to our core wallet business. As digital assets, blockchain technologies and digital asset exchanges continue to expand in popularity and market size, laws and regulations governing un-hosted self-custody wallet providers like Exodus may also develop. In order to ensure compliance with these rules, regulations and laws, we monitor these areas closely and invest significant resources in our legal, compliance, product and engineering teams to ensure our business practices evolve to help us comply with the current laws, regulations and legal standards to which we are subject, as well as to plan and prepare for changes in interpretations thereof, as well as additional laws, regulations, and legal standards that are introduced in the future. Despite our efforts to comply with applicable laws and regulations, any actual or perceived failure to meet applicable requirements may result in an adverse effect on our business. As an example of how the uncertain and developing regulatory regime for digital assets, blockchain technologies and digital exchanges may impact our business as a self-custody wallet provider, earlier this year, the FCA published new rules relating to how digital assets can be marketed to consumers. Specifically, companies seeking to promote digital assets in the U.K. to retail consumers are required to register with the FCA or have any marketing approved by an authorized company. The Company cannot register with the FCA because it operates a self-custodial wallet, and the rules are focused on asset custodians. Therefore, in anticipation of these rules taking effect on October 8, 2023, the Company took steps before the deadline to comply with the new FCA rules by modifying its marketing materials to avoid a determination by the FCA that it was promoting digital assets. Even with the steps taken by the Company, and although at the time the Company believed it was in compliance with such rules, the FCA utilized the broad nature of the new rules to state that the Company is not in compliance with the rules and placed the Company on its Warning List in November 2023. In April 2024, following months of constructive dialogue with the FCA, the FCA removed the Company from its Warning List. Had the Company failed to reach an agreement with the FCA to be removed from the Warning List, it may have had a negative effect on the Company's financial performance and operations and, in the future, we could have been subject to a variety of civil, criminal and administrative fines, penalties, orders and actions as a result of our business activities. To the extent we are required to comply with new regulations, or if licenses or other authorizations are required in one or more jurisdictions in which we operate or will operate, there is no guarantee that we will be able to comply with such regulations or be granted such licenses or authorizations. We may need to change our business model to comply with these legal or regulatory requirements, licensing and/or registration requirements in order to avoid violating applicable laws or regulations. Various legislative and executive bodies in the U.S. and in other countries may, in the future, adopt laws, regulations, guidance or other actions which may severely impact the development and growth of the Exodus Platform. Failure by Exodus, or certain users of the Exodus Platform, to comply with any laws, rules and regulations, some of which may not exist yet or are subject to interpretation and may be subject to change, could result in a variety of adverse consequences, including civil penalties and fines. Despite our efforts to comply with applicable laws and regulations, any actual or perceived failure to meet applicable requirements may result in an adverse effect on our business. Further, as digital assets, blockchain technologies and digital asset exchanges continue to expand in popularity and market size, federal and state agencies have begun to regulate their use and operation. State regulators in New York, Texas, New Hampshire, North Carolina and Washington have created new regulatory frameworks, published guidance on existing laws and regulations or amended their state's statutes to include cryptocurrencies in their existing licensing requirements. Federal law continues to evolve as well. The USDOT, the SEC and the Commodity Futures Trading Commission ("CFTC") and the IRS have published guidance on the treatment of digital assets. Both federal and state agencies have instituted enforcement actions against those violating their interpretation of existing laws. While we have implemented policies and procedures, including geo-blocking technology, designed to help monitor for and ensure compliance with existing and new laws and regulations, there can be no assurance that we and our employees, contractors and agents will not violate or otherwise fail to comply with such laws and regulations.

Although we believe we are currently compliant with U.S. tax reporting and withholding requirements with respect to our customers' digital asset transactions, the scope and application of such requirements is set to change following finalized regulations (the "Regulations") by the USDOT and the IRS published on December 27, 2024. Barring legislative or regulatory action in the interim, these Regulations will treat us as a broker for tax purposes of reporting for sales of digital assets effected on or after January 1, 2027. As of February 2025, Congress was working to advance a joint resolution of disapproval under the Congressional Review Act, which would effectively nullify the Regulations and prohibit any future promulgation of substantially similar rules. If implemented as is, however, the Regulations will require us to invest substantially in new compliance measures. If the IRS determines that we are not in compliance with our tax reporting or withholding requirements with respect to customer digital asset transactions, we may be exposed to significant taxes and penalties, which could adversely affect our financial position. Any actual or perceived failure by us to comply with the above or any other emerging tax regulations that apply to our operations could harm our business.

Our platform or our API Providers' platforms may be exploited to facilitate illegal activity including fraud, money laundering, gambling, tax evasion and scams. We, our API Providers or our partners may be specifically targeted by individuals seeking to conduct fraudulent transfers, and it may be difficult or impossible for us to detect and avoid such transactions in certain circumstances. The use of our platform for illegal or improper purposes could subject us to claims, individual and class action lawsuits, and government and regulatory investigations, prosecutions, enforcement actions, inquiries, or requests that could result in liability and reputational harm for us. In the event that a customer is found responsible for intentionally or inadvertently violating the laws in any jurisdiction, we may be subject to governmental inquiries, enforcement actions, prosecution, or otherwise held secondarily liable for aiding or facilitating such activities. Owners of intellectual property rights or government authorities may seek to bring legal action against software providers for involvement in the sale of infringing or allegedly infringing items. Any threatened or resulting claims could result in reputational harm, and any resulting liabilities, loss of transaction volume or increased costs could harm our business. Moreover, while illegal activities are primarily facilitated through the use of fiat currencies, digital assets are relatively new and, in many jurisdictions, may be lightly regulated or largely unregulated. Many types of digital assets have characteristics, such as the speed with which digital currency transactions can be conducted, the ability to conduct transactions without the involvement of regulated intermediaries, the ability to engage in transactions across multiple jurisdictions, and the irreversible nature of certain digital asset transactions, and encryption technology that anonymizes these transactions, that make digital assets susceptible to use in illegal activity. U.S. federal and state and foreign regulatory authorities and law enforcement agencies, such as the Department of Justice ("DOJ"), SEC, Commodities Futures Trading Commission ("CFTC"), FTC, OFAC or the Internal Revenue Service ("IRS"), and various state securities and financial regulators have taken and continue to take legal action against persons and entities alleged to be engaged in fraudulent schemes or other illicit activity involving digital assets. We also support digital assets that incorporate privacy-enhancing features, and may from time to time support additional digital assets with similar functionalities. These privacy-enhancing digital assets obscure the identities of sender and receiver, and may prevent law enforcement officials from tracing the source of funds on the blockchain. Facilitating transactions in these digital assets may cause us to be at increased risk of liability arising out of anti-money laundering and economic sanctions laws and regulations.

Aspects of the Exodus Platform and our applications include or utilize software released under the terms of open source licenses, including the MIT License, Internet Systems Consortium License, Apache License, Mozilla Public License and GNU Lesser General Public License. While we monitor our use of open source software ("OSS"), we could be subject to suits for noncompliance with open source licensing terms, infringement on a third party's intellectual property rights or indemnification. Such inadvertent use could also require us to release our proprietary source code, pay damages, royalties, license fees or other amounts, seek new licenses from third parties, re-engineer our platform or applications, discontinue sales or distribution of software in the event re-engineering cannot be accomplished on a timely basis or take other remedial action that may divert resources away from the operation of our business, maintenance of our platform or our development efforts, any of which could adversely affect our business.

Employee or service provider misconduct or error could subject us to legal liability, financial losses, and regulatory sanctions and could seriously harm our reputation and negatively affect our business. Such misconduct could include engaging in improper or unauthorized transactions or activities, insider trading and misappropriation of information, failing to supervise other employees or service providers, improperly using confidential information, as well as improper trading activity such as spoofing, layering, wash trading, manipulation and front-running. Additionally, our API Providers may misappropriate customer funds or digital assets. API Provider errors, include mistakes in executing, recording, or processing transactions for users. Although we have implemented processes and procedures and provide training to our employees to reduce the likelihood of misconduct and error and require our API Providers to make representations to us to their processes and procedures regarding the same, these efforts may not be successful. It is not always possible to deter misconduct, and the precautions we and our API Providers take to prevent and detect this activity may not be effective in all cases. If we were found to have not met our compliance and other obligations, we could be subject to regulatory sanctions, financial penalties, restrictions on our activities for failure to properly identify, monitor and respond to potentially problematic activity and seriously damage our reputation. Our employees, contractors and agents could also commit errors that subject us to financial claims for negligence, as well as regulatory actions, or result in financial liability. Further, allegations by regulatory or criminal authorities of improper trading activities could affect our brand and reputation. If our API Providers were found to have not met their regulatory oversight and compliance and other obligations or if our API Providers experience bankruptcy or insolvency, we could receive negative publicity and damage to our reputation that could adversely impact our business.

The Exodus Platform allows users to access the services offered and performed by our API Providers. The services provided by our API Providers allow users to engage in transactions such as digital asset exchanging, fiat onboarding and staking products for over 21,000 digital assets. We conduct KYB and other diligence with respect to our API Providers, and we understand that, in turn, the API Providers conduct AML and KYB procedures with respect to their service providers in accordance with their respective policies, procedures and regulatory obligations. However, we do not independently conduct diligence with respect to the third parties with which our API Providers contract. For example, we do not conduct diligence with respect to the exchanges and market makers with which our API Provider's contract to support the services they provide to their users (including any users from the Exodus Platform). Because Exodus does not independently conduct diligence with respect to these third parties, we cannot assure users as to these third parties or the processes and procedures our API Providers use to engage such third parties. Our API Providers and the third parties with whom they contract may be subject to financial, legal, regulatory, and labor issues, cybersecurity incidents, disruptions, interruptions, and other misconduct of which we are not aware. Should any of the foregoing materialize and lead to disruptions or issues in third party operations, risks to our users may include loss of information stored with or provided to the API Provider, along with loss of access to the digital assets or fiat currency used in any pending transaction with the API Provider. In such instances, because we do not control the operations of any of our API Providers or third parties with which they contract, we will be unable to intervene and can make no assurances as to the outcome of any issue or dispute between the user and API Provider. In these scenarios, users may blame or become dissatisfied with the Exodus Platform as a result of these negative experiences, which could adversely affect our ability to access or sell our digital services and subject us to legal or regulatory scrutiny, reputational harm and significant financial losses.

Certain supported digital assets enable holders to earn rewards by participating in decentralized governance, bookkeeping and transaction confirmation activities on their underlying blockchain networks, such as through staking activities, including staking through validation, delegating and baking. Staking allows users to "stake" supported digital assets held in their Exodus wallets by participating in blockchain validation through a third-party API Provider, Everstake. Everstake currently provides and is expected to continue to provide such services for certain supported crypto assets to our users in order to enable them to earn rewards based on crypto assets held in their Exodus wallets. Everstake's network may further require customer assets to be transferred into smart contracts on the underlying blockchain networks not under Everstake's or anyone's control. If Everstake or smart contracts fail to operate as expected, suffer cybersecurity attacks, experience security issues or encounter other problems, our users' assets may be irretrievably lost. In addition, certain blockchain networks dictate requirements for participation in the relevant decentralized governance activity, and may impose penalties, or "slashing," if the relevant activities are not performed correctly, such as if the staker, delegator or baker acts maliciously on the network, "double signs" any transactions, or experience extended downtimes. If Everstake is slashed by the underlying blockchain network, our users' assets may be confiscated, withdrawn or burnt by the network. Any penalties or slashing events could damage our brand and reputation, discourage existing and future customers from utilizing Everstake's services, and adversely impact our staking revenue earned through Everstake.

We believe that maintaining our reputation as a leading provider of a self-custodial digital asset wallet with superior user support is critical to our relationship with our existing users and our ability to attract new users. The successful promotion of our brand will depend on several factors, including our ability to maintain a record of security, performance and reliability; our ability to continue to develop and integrate high-quality products and features for our platform through API agreements; and our ability to successfully differentiate our platform from competitive products and services. Independent industry and financial analysts often provide reviews of our platform, as well as those of our competitors. Perception of our offerings in the marketplace may be significantly influenced by these expert reviews. If reviews of our platform are negative or less positive than those of our competitors our brand may be adversely affected. The performance and reputation of our third-party API Providers may also affect our brand and reputation, particularly if users do not have a positive experience with our API Providers. Further promotion of our brand may require us to make increased expenditures and we anticipate that the expenditures will increase as our market becomes more competitive. Expenditures intended to maintain and enhance our brand may not be cost-effective or effective at all. If we do not successfully maintain and enhance our brand, we may experience reduced pricing power relative to our competitors, a decrease in existing users, failure to attract new users or an inability to expand offerings of new products to our existing users, all of which could materially and adversely affect our business, results of operations and financial condition.

Digital asset exchanges may be susceptible to "front-running," which refers to the process whereby someone uses technology or market advantage to obtain information about upcoming transactions. Front-running is a frequent activity on centralized as well as decentralized exchanges. By using bots functioning on a millisecond-scale timeframe, bad actors are able to take advantage of the forthcoming price movement and make economic gains at the cost of those who conducted these transactions. The objective of a front runner is to buy a chunk of tokens at a low price and later sell them at a higher price. Front-running happens via manipulations of gas prices or timestamps, also known as slow matching. To the extent that front-running occurs, it may result in investor frustrations and concerns as to the price integrity of digital asset exchanges and digital assets more generally.