SUI Group Holdings Ltd.

Current report

We have made, and may continue to make, loans to and minority investments in the digital asset, financial technology and artificial intelligence sectors, which subject us to distinct operational, regulatory, valuation, and liquidity risks that are separate from, and in addition to, the risks associated with our digital asset treasury strategy.

Current report

Digital assets, financial technology and artificial intelligence are dynamic sectors, each subject to its own rapidly evolving and unsettled regulatory landscape. Financial technology entities in which we invest may be subject to evolving money transmission, banking, consumer protection, and other financial services regulation that varies by jurisdiction. Artificial intelligence entities in which we invest are subject to a separate and equally unsettled body of law, including emerging AI-specific legislation such as the European Union's Artificial Intelligence Act and a growing number of U.S. state AI laws, the application and enforcement of which remain difficult to predict. Changes in, or new interpretations of, the laws and regulations applicable to either sector could materially and adversely affect the business, financial condition, or prospects of the entities in which we invest, and in turn, the value of our investments.

Current report

Because these are minority investments, we generally do not, and may not in the future, control the management, strategic direction, development, or commercialization of the underlying technologies or businesses. While we may seek to negotiate board observer rights, information rights, or other protective provisions in connection with such investments, there is no assurance that we will obtain such rights, or that any rights we do obtain will be sufficient to protect our investment or allow us to meaningfully influence the entity's strategic or operational decisions. Other investors in these entities may have business goals and interests that differ from, or conflict with, our own.

Current report

These entities are frequently early-stage, unproven, and face significant competition, and their technologies may never be successfully developed, commercialized, or adopted by the market. Our investments in these entities are illiquid and non-marketable at the time of investment, are typically subject to transfer restrictions, and generally have no public trading market. Any return of, or return on, our capital depends on the performance of the technology and the operating company and may depend on a future liquidity event — such as an initial public offering, acquisition, or follow-on financing at a higher valuation — that may never occur, or that may occur on terms less favorable than we anticipate. If any entity in which we hold a minority investment is unable to obtain additional financing, fails to achieve commercial success, or ceases operations, we could lose all or a substantial portion of our invested capital.

Current report

As our capital allocated to non-digital-asset investments increases, we may also become subject to additional risks under the Investment Company Act of 1940, as described in the Risk Factor included in our Annual Report and titled “If we were deemed to be an investment company under the 1940 Act, applicable restrictions likely would make it impractical for us to continue segments of our business as currently contemplated.”

Current report

Risks Related to Agentic Artificial Intelligence

Current report

The rapid development and deployment of AI models capable of autonomous decision-making, task execution, and interaction with external systems with limited or no human oversight—known as agentic artificial intelligence (“agentic AI”)— pose significant and evolving risks to our financial condition and results of operations.

Current report

We, our contract counterparties, entities we invest in, or our service providers may integrate agentic AI tools into our operations, including in connection with trading, compliance monitoring, cybersecurity and blockchain analytics. While these tools may enhance efficiency, because these systems operate with reduced human supervision relative to traditional software and earlier AI applications, they also introduce novel and potentially significant risks, including risks related to model accuracy and reliability, unintended actions, data security and privacy, third-party system dependencies, intellectual property, regulatory compliance, and potential liability for outcomes produced or actions taken by such systems. Agentic AI may take actions that are unintended, erroneous, or inconsistent with our policies, risk tolerances, or applicable legal and regulatory requirements. Errors or unintended behaviors may propagate rapidly and at scale before they are detected and corrected, potentially resulting in material financial losses, regulatory violations or reputational harm.

Current report

Agentic AI may also significantly enhance the offensive capabilities of malicious actors targeting our systems or infrastructure. Unlike traditional cyberattacks that require sustained human direction, agentic AI can autonomously identify vulnerabilities, adapt attack strategies in real time, and coordinate complex, multi-stage intrusions across various attack surfaces, such as smart contracts, cross-chain protocols and third-party integrations, with minimal human involvement. These AI-driven offensive capabilities may lower the cost and technical expertise required to launch attacks, broaden the pool of potential threat actors, and enable attacks of a speed, scale, and complexity that exceed the capacity of our existing security infrastructure. As a result, traditional perimeter controls and static security rules are no longer the most effective security mechanisms. As agentic AI tools become more widely accessible, we anticipate that the frequency, sophistication, and severity of AI-powered attacks will increase, and there can be no assurance that our defensive measures will keep pace.

Current report

Our competitors and other participants in the cryptocurrency industry may also deploy agentic AI in ways that could adversely affect us, including through AI-driven trading strategies that increase market volatility, which could materially and adversely impact the value of our digital assets and our revenues. We may also face increased liability and litigation risk arising from the actions or outputs of agentic AI, and the legal and regulatory frameworks governing autonomous AI-driven actions are unsettled and evolving rapidly. Furthermore, the market for AI talent is highly competitive, and our inability to attract and retain personnel with the specialized expertise necessary to oversee agentic AI or counteract these threats could further impair our ability to manage these risks.

Current report

No assurance can be given that we will be able to effectively anticipate, manage, or mitigate the risks associated with agentic AI. The failure to do so could have a material adverse effect on our business, financial condition and results of operations.

Previous report

If we or our third‑party service providers or partners experience a security breach or cyberattack and unauthorised parties obtain access to our SUI, or if our private keys are lost, compromised or destroyed, we may lose some or all of our SUI and our financial condition and results of operations could be materially adversely affected.

Previous report

Substantially all of the SUI we own is held in custody accounts at BitGo, a well‑known custodian. Security breaches and cyberattacks are of particular concern with respect to our SUI. SUI and other blockchain‑based cryptocurrencies, and the entities that provide services to participants in the SUI ecosystem, have been, and may in the future be, subject to security breaches, cyberattacks or other malicious or unauthorised activities. In recent years, several digital asset platforms and custodial service providers have experienced significant cybersecurity incidents, including large‑scale thefts resulting from the compromise of private keys and other custody‑related controls. These incidents have included compromises of processes and systems that were designed to enhance security, such as offline or “cold storage” arrangements and multi-signature authorisation workflows.

Previous report

For example, in February 2025, a major cryptocurrency exchange reported that unauthorised actors had compromised a cold‑wallet custody system and stolen approximately $1.5 billion in digital assets, illustrating that custody solutions designed to operate offline may be vulnerable to increasingly sophisticated attacks.

Previous report

Further, it has been reported publicly that cyber attacks targeting decentralized finance (“DeFi”) systems focus increasingly on off-chain infrastructure, governance processes, cross-chain messaging and verification mechanisms, and human factors, which increases the attacks’ sophistication and the likelihood of success. For example, in April 2026, it was reported that a liquid restaking protocol suffered an exploit involving a forged cross-chain message that resulted in the unauthorised release of approximately $292 million in rsETH, with subsequent impacts across interconnected DeFi lending markets. Published incident analysis described the event as an attack on off-chain verification and infrastructure, rather than a flaw in the core smart contracts. Similarly, reporting regarding a separate April 2026 exploit of a Solana-based DeFi protocol described how an attacker used “durable nonces,” a legitimate Solana transaction feature, to pre-sign administrative transfers weeks before executing them and illegally obtain substantial assets, without requiring exploitation of a coding vulnerability in the protocol’s programs.

Previous report

Similar incidents affecting other market participants could occur in the future. A successful security breach or cyberattack, whether affecting us or a third-party service provider or partner on which we rely, could result in a partial or total loss of our SUI in a manner that may not be covered by insurance or the liability provisions of the custody agreements with the custodians who hold our SUI; harm to our reputation and brand; improper disclosure of data and violations of applicable data privacy and other laws; or significant regulatory scrutiny, investigations, fines, penalties and other legal, regulatory, contractual and financial exposure and increased costs to strengthen our information security and operational controls, including costs associated with incident response, business continuity measures, enhanced monitoring, third-party assessments, and remediation.

Previous report

Although we believe that holding SUI in cold storage reduces certain theft risks, cold storage does not eliminate cybersecurity risk. Publicly reported incidents have involved the compromise of transaction approval workflows, signing interfaces, multi-signature processes, or other operational controls that are adjacent to cold storage rather than direct online theft of private keys, and there is a risk therefore that such incidents may take place. In addition, we have engaged in protocol-level and yield-generating activities that may require transferring SUI out of custody accounts or otherwise exposing our SUI holdings to additional technological, operational, smart contract, and counterparty risks. These activities have included native staking, liquid staking and restaking, and during the reporting period, participation in decentralized finance protocols through third-party asset management arrangements. Following the end of the reporting period, the Company unwound all decentralized finance (“DeFi”) positions and recovered all amounts involved therein in response to security incidents affecting certain DeFi ecosystems.

Previous report

Further, any actual or perceived data security breach or cybersecurity attack directed at other companies with digital assets or companies that operate digital asset networks, regardless of whether we are directly impacted, could lead to a general loss of confidence in the broader SUI ecosystem or in the use of the SUI network to conduct financial transactions, which could negatively impact us. This may be true even where the attacks do not directly involve our custodian, our third-party service providers or partners, or our SUI holdings, because our stock price may be influenced by broader perceptions of the security of digital assets, DeFi protocols, and the SUI ecosystem. Such events may lead to reduced user activity, reduced liquidity, higher risk premiums demanded by investors, heightened regulatory scrutiny, and increased volatility in the trading price of digital assets and digital asset related securities, including our common stock, as well as other legal, regulatory, contractual and financial exposure and increased costs.

Previous report

Attacks upon systems across a variety of industries, including industries related to digital assets, are increasing in frequency, persistence and sophistication and, in many cases, are being conducted by sophisticated, well‑funded and highly organised groups and individuals, including state‑sponsored actors. The techniques used to obtain unauthorised access to systems or information (including personal data and digital assets), disable or degrade services, or sabotage systems are constantly evolving, may be difficult to detect quickly, and often are not recognised or detected until after they have been launched against a target. These attacks may occur on our systems or those of our third‑party service providers or partners.

Previous report

We may experience breaches of our security measures due to human error, malfeasance, insider threats, system errors or vulnerabilities or other irregularities. In particular, we expect that unauthorised parties may attempt to gain access to our systems or those of our partners and third‑party service providers, through methods such as hacking, social engineering, phishing and fraud. Threats can come from a variety of sources, including criminal hackers, hacktivists, state‑sponsored intrusions, industrial espionage and insiders. Certain threats may target individuals involved in transaction approvals, custody arrangements, and other high privilege activities, including through impersonation, fraudulent communications, and other deception tactics.

Previous report

Recent publicly reported incidents in the digital asset industry have demonstrated that attackers may target individuals with authority to approve transactions or changes to system configurations, including through impersonation, relationship building, and other forms of social engineering designed to obtain misrepresented approvals rather than exploit code vulnerabilities. Attacks of this nature may be difficult to prevent, may not be detected until after assets have been transferred, and may be more likely where functions are performed by a small number of authorised personnel at us or at our third-party service providers or partners.

Previous report

In addition, certain types of attacks could harm us even if our systems are not directly compromised. Some threats are designed to remain dormant or undetectable, sometimes for extended periods of time, or until launched against a target, and we may not be able to implement adequate preventative measures in all cases. Cybersecurity risk may also be heightened by cyberwarfare in connection with ongoing geopolitical conflicts or other future conflicts. Any future breach of our operations, or of the operations of third parties relied upon by participants in the SUI ecosystem, could materially adversely affect our financial condition and results of operations.

Previous report

We rely on digital technologies, including information systems, infrastructure and cloud applications and services, including those belonging to third parties with whom we deal. Sophisticated and deliberate attacks on, or security breaches in, our systems or infrastructure, or the systems or infrastructure of third parties or the cloud, could lead to corruption or misappropriation of our assets, proprietary information and sensitive or confidential data, including personal data.

Previous report

We rely in part on the data‑security measures implemented by third‑party service providers or partners with whom we deal, and we may not be sufficiently protected against such occurrences. We may not have sufficient resources to adequately protect against, or to investigate and remediate, any vulnerability to cyber incidents. It is possible that any of these occurrences, or a combination of them, could have adverse consequences on our business and lead to financial loss. In addition, our participation in activities that involve deploying digital assets outside of cold storage, including staking, liquid staking, and transactions involving tokens or instruments representing staked positions, may increase the attack surface and introduce additional risks related to smart contracts, protocol design, cross-chain infrastructure, and counterparty operational controls.

Previous report

The use of, or inability to use, artificial intelligence by us, our employees, consultants, directors, vendors, investors or contract counterparties presents risks and challenges that may adversely impact our business and operating results or the business and operating results of our vendors, investors or contract counterparties.

Previous report

We may use generative artificial intelligence and/or machine‑learning technologies (collectively, “AI”) in our operations. While AI tools may facilitate optimisation and operational efficiencies, they also present risks, including inaccurate or biased outputs, intellectual property or data‑privacy concerns, and cybersecurity vulnerabilities. In addition, cybersecurity threat actors may use AI‑enabled tools to enhance the scale, speed or effectiveness of attacks against us or our third‑party service providers or partners. AI-enabled tools may assist threat actors to create more convincing social engineering lures, automate reconnaissance, accelerate the development of malicious code, and tailor attacks to specific individuals, including those involved in custody, transaction approvals, and other high privilege functions. These developments could increase the likelihood of successful attacks and reduce the time available to detect and respond to incidents, as well as the likelihood of other legal, regulatory, contractual and financial exposure and increased costs.

Previous report

Business disruptions, including interruptions, delays or failures of our systems or other third‑party services, could materially adversely affect our operating results.

Previous report

Disruptions or failures caused by cyberattacks, natural disasters, acts of terrorism, geopolitical conflict, pandemics, climate‑related events, power outages, telecommunications failures, or changes in the pricing or terms of third‑party services could impair our ability to conduct business operations or result in a material weakness in our internal controls over financial reporting, any of which could materially adversely affect our future operating results.