What changed in this filing

/stocks — the workspaceLOADING

Item 1B. Unresolved Staff Comments

2026-03-19 compared with 2025-03-31 · 23 added, 80 removed, 3 unchanged (97% of the section changed)

Unresolved Staff Comments

Not applicable.

Cybersecurity

Risk Management and Strategy

The Company recognizes the critical importance

of developing, implementing, and maintaining robust cybersecurity measures to safeguard our information systems and protect the confidentiality,

integrity , and availability of our data.

We maintain cybersecurity insurance coverage that provides protection against potential

losses arising from certain cybersecurity incidents.

In addition, we have developed the following processes as part of our strategy for

assessing, identifying, and managing material risks from cybersecurity threats.

Managing Material Risks and Integrated Overall

Risk Management

We have integrated cybersecurity risk management

into our risk management processes.

This integration is intended to ensure that cybersecurity considerations are part of our decision-making

We continuously evaluate and address cybersecurity risks in alignment with our business objectives and operational needs.

We have adopted the standard 2FA (two factor authentication)

for all our eData access (emails, online storage, etc.).

In addition, all our applications and third-party applications have timed, authentication

and environmental disposable cookie processes that force every user to reauthenticate their credentials.

Our business transactional data

includes dumb access controls that are vendor-specific, a set or specified range of costs, faceless entry point, and a unique 4FA (four

factor authentication) process, protecting access to our banking and application systems.

Moreover, our commitment to data security extends

beyond industry standards through the implementation of advanced access controls.

We have developed a sophisticated access control system,

referred to as “dumb access controls,” which limits access to only specific vendors within a predefined range of costs.

system operates through a faceless entry point with a unique 4FA process, ensuring that access to sensitive banking or application systems

is strictly controlled and virtually nonexistent for unauthorized entities.

These comprehensive security measures not only protect our

business transactional data but also uphold the integrity and confidentiality of our systems and information assets.

Engaging Risk Management Systems and Third-Party

Recognizing the complexity and evolving nature

of cybersecurity threats, we use risk management systems developed and tested by external experts, including cybersecurity assessors,

consultants, and auditors.

These risk management systems enable us to leverage specialized knowledge and insights as part of our cybersecurity

strategies and processes.

These systems are assessed and maintained with the assistance of third-party service providers, including a

Technology Consultant engaged by the Company.

Overseeing Third-Party Risk

Because we are aware of the risks associated with

third-party service providers, we implement processes to oversee and manage these risks.

We conduct thorough security assessments of all

third-party providers before engagement and maintain ongoing monitoring to ensure compliance with our cybersecurity standards.

The monitoring

includes regular assessments by our Chief Technology Officer.

This approach is designed to mitigate risks related to data breaches or

other security incidents originating from third parties.

Risks from Cybersecurity Threats

We have not encountered cybersecurity challenges

that have materially affected or are reasonably likely to materially affect us, including our business strategy, results of operations,

or financial condition.

Board of Directors Oversight

Our board of directors oversees the management

of risks associated with cybersecurity threats.

Management’s Role Managing Risk

The Company’s Chief Technology Officer,

Chief Operating Officer, and Technology Consultant are primarily responsible for assessing, monitoring and managing our cybersecurity

Our Chief Technology Officer must ensure that all industry standard cybersecurity measures are functioning as required to prevent

or detect cybersecurity threats and related risks.

The Chief Technology Officer provides briefings on cybersecurity threats and related

risks to our Chief Executive Officer on a regular basis.

Our Chief Technology Officer has nine years of experience in the field of information

The Chief Technology Officer oversees and tests our compliance with standards, remediates known risks, and leads our employee

training program.

The Company’s Chief Technology Officer and Technology Consultant have extensive experience in cybersecurity and

possess the necessary knowledge, skills, background, and experience.

Monitoring Cybersecurity Incidents

The Company’s Chief Technology Officer and

Technology Consultant are continually informed about the latest developments in cybersecurity, including potential threats and innovative

risk management techniques.

The Chief Technology Officer and Technical Consultant implement and oversee processes for the regular monitoring

of our information systems.

This includes the deployment of industry-standard security measures and regular system audits to identify

potential vulnerabilities.

In the event of a cybersecurity incident, the Chief Technology Officer and Technical Consultant will implement

an incident response plan.

This plan includes immediate actions to mitigate the impact and long-term strategies for remediation and prevention

of future incidents.

Reporting to Board of Directors

Significant cybersecurity matters, and strategic

risk management decisions, will be escalated to the board of directors.

We have implemented a comprehensive risk management framework, which includes policies and procedures designed for assessing, identifying, and managing material cybersecurity threats and facilitating timely disclosure of material cybersecurity incidents.

Our security approach is built on three core principles:

defense in depth (layered security), least privilege access, and a risk-based approach that prioritizes security resources based on risk assessment.

Our policies require mandatory annual cybersecurity awareness training for all employees, focusing on phishing and social engineering recognition and reporting, among other areas.

We evaluate potential security risks and conduct routine incident response tabletop exercises to practice responding to realistic cybersecurity incident and data breach scenarios.

We undertake annual reviews of our policies, which are designed to help ensure their effectiveness and relevance in light of evolving cybersecurity threats.

We have also implemented controls designed to identify and mitigate cybersecurity threats associated with our use of third-party service providers, including by reviewing evidence that their systems meet appropriate cybersecurity requirements for key service providers.

We collaborate with our service providers to understand developments within their cybersecurity framework and to seek to ensure service providers notify us promptly of

cybersecurity threats or incidents that may affect our systems or data.

Additionally, we maintain cyber insurance to help cover costs associated with cybersecurity events and to provide access to a panel of approved incident response partners, including forensics and incident response firms, law firms, breach notification providers, public relations firms, and distributed denial-of-service mitigation services.

We also engage third parties to assist in our cybersecurity mitigation and detection efforts, including a managed service provider ("MSP") that provides, among other things, cybersecurity monitoring and threat detection through a Security Information and Event Management system, security assessments and penetration testing, and Virtual Chief Information Security Officer services.

The MSP operates as an extension of our Corporate Strategy professionals, who, as discussed below, manage the Company’s information technology and cybersecurity risk management initiatives, and is bound by the same security and confidentiality obligations as the Company’s employees.

Our incident response and data breach procedures apply to all employees, contractors, and third-party users and are designed to provide a comprehensive, structured response to cybersecurity threats and incidents.

Upon receiving an incident report, Corporate Strategy and our MSP perform an initial assessment to determine severity level, whether escalation to executive leadership is needed, and whether cyber insurance notification and approved partner engagement is required.

For potentially significant cybersecurity incidents, we engage insurance-approved partners based on the nature and scope of the incident, and Corporate Strategy coordinates with our executive leadership to manage the incident response, investigation, notification, and remediation process.

In 2025, we have not identified any cybersecurity threats or incidents, including those resulting from any previous cybersecurity incidents, that have materially affected, or, to our knowledge, are reasonably likely to materially affect, us or our business strategy, results of operations or financial condition.

However, despite our efforts, we cannot eliminate all risks from cybersecurity threats or incidents, or provide assurances that we have not experienced an undetected cybersecurity incident.

For more information about these risks, please see “Risk Factors—Risks Related to Our Business—If we or our third-party service providers experience a security breach or cyberattack and unauthorized parties obtain access to our bitcoin holdings, or if our private keys are lost or destroyed, or other similar circumstances or events occur, we may lose some or all of our bitcoin and our financial condition and results of operations could be materially adversely affected.”

Our board of directors, in coordination with our Audit Committee, oversees our risk management process, including cybersecurity risks.

The Audit Committee receives regular reports from our executive leadership and our Vice President of Corporate Strategy on the threat landscape and the Company’s cybersecurity program.

Our Corporate Strategy department manages the Company's information technology operations and cybersecurity risk management and is responsible for receiving incident reports, performing initial assessments, coordinating approved partner engagement, leading investigations, overseeing remediation, and managing communications related to cybersecurity incidents.

The Vice President of Corporate Strategy , who is responsible for the establishment and maintenance of our cybersecurity program, as well as the assessment and management of cybersecurity risks, has significant experience in information technology and possesses the requisite education, skills, and experience expected of an individual assigned to these duties.

Our executive leadership, including our Chief Executive Officer, Chief Financial Officer, Chief Risk Officer, and Chief Legal Officer, provides oversight of our cybersecurity risk management program and receives regular updates from the Vice President of Corporate Strategy.

Compared sentence by sentence after normalising whitespace, quotation marks, case and digits, so re-formatting and restated figures do not read as changed language. Wording changes appear as one removal and one addition. The current filing and the prior one are authoritative.

What changed 10-K

Item 1B. Unresolved Staff Comments