Hashdex Commodities Trust 10-K

Item 1B. Unresolved Staff Comments There are no unresolved staff comments. Item 1C. Cybersecurity Risk Management and Strategy The Trust does not have any employees or a dedicated information technology infrastructure. The Trust's cybersecurity risk management relies on the programs and practices maintained by the Sponsor and the Trust's key third-party service providers. The Sponsor is part of the Hashdex group of companies, which includes Hashdex Gestora de Recursos Ltda. ("Hashdex Gestora"), a Brazilian-regulated asset management firm that has adopted a formal Information Security and Cybersecurity Policy. While this policy is formally adopted at the Hashdex Gestora level, the Sponsor applies cybersecurity procedures and controls consistent with the principles and standards set forth in that policy across its operations, including those relating to the Trust. The Sponsor's cybersecurity risk management processes are integrated into its overall risk management framework. At least annually, the Sponsor conducts a cybersecurity risk assessment to identify internal and external threats and evaluate the adequacy of existing controls, considering potential financial, operational, and reputational impacts. The Sponsor may engage specialized third-party firms to assist with these assessments when deemed necessary. 24 The Sponsor has implemented preventive and detective controls, including monitoring of workstations and network components, periodic vulnerability and penetration testing, multi-factor authentication requirements, encryption protocols, employee cybersecurity training conducted at least annually, and an incident response framework aligned with its Business Continuity Plan. The Sponsor also maintains processes to oversee and identify material cybersecurity risks associated with the Trust's use of third-party service providers. Prior to engaging third parties that will have access to confidential information or systems, the Sponsor conducts a cybersecurity due diligence evaluation assessing, among other things, whether the third party maintains formal information security policies, an incident response plan, adequate data protection mechanisms, and all necessary certifications. These evaluations are periodically reassessed and the Sponsor includes information security requirements in its service agreements. As of December 31, 2025, no cybersecurity threats or incidents, including as a result of any previous cybersecurity incidents, have materially affected or are reasonably likely to materially affect the Trust, including its business strategy, results of operations, or financial condition. Governance The Trust is organized as a Delaware statutory trust and does not have a board of directors. The Sponsor is solely responsible for the management and control of the Trust's business and affairs, including oversight of cybersecurity risks. The Sponsor has established a risk and compliance committee (the "Risk & Compliance Committee"), composed of the head of the risk and compliance function and the risk and compliance team. The Risk & Compliance Committee meets at least quarterly and is responsible for the supervision and monitoring of cybersecurity practices applicable to the Sponsor's activities, including those relating to the Trust. Item 2. Properties None. Item 3. Legal Proceedings Neither the Trust, the Fund or the Sponsor are currently subject to any material legal proceedings, nor, to our knowledge, are any material legal proceedings threatened against the Trust, the Fund or the Sponsor. Item 4. Mine Safety Disclosures Not applicable. Part II.