Galaxy Statement on Recent Security Incidents

Galaxy's staking services and infrastructure were not impacted by the security attacks on September 8, 2025, including both the Node Package Manager (NPM) supply chain and SwissBorg incidents. All client assets remain secure.

As part of our security-first approach, we immediately performed a series of checks to confirm the integrity of our systems:

• Access Log Review: Audited infrastructure access logs to verify that sensitive encryption keys were never accessed. Our systems include real-time, high-sensitivity alerting that would have immediately flagged any abnormal behavior.

• Database and On-Chain Verification: Revalidated all staking requests to ensure client-specified withdrawal and fee recipient addresses were honored exactly as submitted. This was cross-checked against on-chain state for accuracy.

• Environment Scans: Performed scans across our infrastructure to confirm that no environments contained packages affected by the recent NPM supply chain attack.

Our staking infrastructure employs a comprehensive security strategy with multiple, independent layers of protection. Validators run in isolated environments with no public access, controls are enforced through strict authentication and least-privilege access, and critical processes are backed by redundant systems to ensure continuity, even in the face of failures. Combined with robust change management and automated safeguards, this layered approach significantly reduces risk and strengthens resilience.

While Galaxy's systems were unaffected, we treat every incident in the ecosystem as an opportunity to reaffirm our resilience and commitment to keeping client assets secure.

If you would like to discuss our security practices in more detail, please reach out to our team.

About Galaxy

Galaxy (Nasdaq/TSX: GLXY) is a global leader in digital assets and data center infrastructure, delivering solutions that accelerate progress in finance and artificial intelligence. Our digital assets platform offers institutional access to trading, advisory, asset management, staking, self-custody, and tokenization technology. In addition, we invest in and operate cutting-edge data center infrastructure to power AI and high-performance computing, meeting the growing demand for scalable energy and compute solutions in the U.S. The company is headquartered in New York City, with offices across North America, Europe, the Middle East and Asia. Additional information about Galaxy's businesses and products is available on www.galaxy.com.

Disclaimer:

The TSX has not approved or disapproved of the information contained herein.

Caution About Forward-Looking Statements:

The information in this document may contain "forward-looking statements" within the meaning of Section 27A of the Securities Act of 1933, as amended, Section 21E of the Securities Exchange Act of 1934, as amended and "forward-looking information" under Canadian securities laws (collectively, "forward-looking statements"). Our forward-looking statements include, but are not limited to, statements regarding our or our management team's expectations, hopes, beliefs, intentions or strategies regarding the future and tokenized equities. The words "anticipate," "believe," "continue," "could," "estimate," "expect," "forecast," "intend," "may," "might," "plan," "possible," "potential," "predict," "project," "should," "would" and similar expressions may identify forward-looking statements, but the absence of these words does not mean that a statement is not forward-looking. The forward-looking statements contained in this document are based on our current expectations and beliefs concerning future developments and their potential effects on us taking into account information currently available to us. There can be no assurance that future developments affecting us will be those that we have anticipated. These forward-looking statements involve a number of risks, uncertainties (some of which are beyond our control) or other assumptions that may cause actual results or performance to be materially different from those expressed or implied by these forward-looking statements. These risks include, but are not limited to, the risks contained in filings we make with the Securities and Exchange Commission (the "SEC") from time to time, including in our Quarterly Report on Form 10-Q for the quarter ended June 30, 2025, filed with the SEC on August 5, 2025, and available on Galaxy's profile at https://www.sec.gov. Should one or more of these risks or uncertainties materialize, they could cause our actual results to differ materially from the forward-looking statements. Factors that could cause actual outcomes to differ materially from those described in such forward-looking statements include, but are not limited to, challenges with respect to regulations and implementation of the initiatives described.

Except as required by law, we assume no obligation to update or revise any forward-looking statements whether as a result of new information, future events or otherwise, or to update the reasons if actual results differ materially from those anticipated in the forward-looking statements. You should not take any statement regarding past trends or activities as a representation that the trends or activities will continue in the future. Accordingly, you should not put undue reliance on these statements.

©Copyright Galaxy Digital 2025. All rights reserved