September hinged on whether Congress or the agencies would write crypto's rules. The CLARITY Act failed its Senate cloture vote eleven short of sixty, even after a final draft that folded in Democrat ethics and stablecoin concessions, and the SEC answered within days by updating its crypto FAQ to clear token buybacks and post-launch network work on functional networks. Payward outlined a path to bring Hyperliquid to US clients through HIP-3*, Robinhood chose Bitstamp for perps, Bitget and Liquid Network absorbed nine-figure exploits, Ethereum set Hegota priorities alongside a December 2029 quantum deadline, and Maven 11 portfolio companies Firelight, Tenka and functionSPACE raised while Atum and Doppler advanced.
The night before the vote, 14th of September, Senate Republicans released what they called the final draft of the CLARITY Act, with 126 changes made at Democrats' request. The largest concessions sat in the ethics section, the clause which had stalled all progress around the bill. The earlier version barred public officials, employees and their spouses from issuing or sponsoring digital assets, left enforcement to the Justice Department, and expired in January 2029. The final draft adopted most of the compromise instead, giving state attorneys general a role in enforcing conflict-of-interest rules covering elected federal officials, judges and their spouses, and President Trump agreed to most of these provisions. To address the concerns around bank deposit flight, the Treasury secretary would receive an 18-month authority to impose an emergency circuit-breaker on stablecoin rewards if deposit outflows threatened community banks, with interest on idle stablecoin balances already banned and usage-based rewards still permitted. Separately, trading protocols that do not qualify as DeFi, defined as a person or group acting in concert with the authority to control or materially alter a protocol's functionality, would have to register with the CFTC, while the DeFi provisions were narrowed to spot and cash digital commodity transactions to address tribal governments' concerns about prediction markets.
To receive bipartisan support, it was not enough. The cloture vote failed with only 49 votes in favour, eleven short of the 60 required to open the floor debate, effectively blocking the CLARITY Act from advancing. The Democrats who had spent months negotiating, in the end voted against the proposed text. Their objection has remained consistent as it has been throughout the summer. The ethics coverage seemed still weak, arguing that state attorneys general would lack the needed authority to bring cases directly against officials, including the president. As for the actual jurisdictional split between the SEC and CFTC, it has seemingly never been the point of contention, at least before the cloture vote. The sentiment from both sides has been rather optimistic for the future. Few Democrats echoed their concern with the ethics, while showing interest in finding a way to regulate crypto and keep the US ahead of the curve. Other crypto public figures, such as Jake Chervinsky, who has been leading the Hyperliquid Policy Center and is among the influential voices on US crypto policy, framed the outcome as a positive one as the industry refused a bad bill rather than lost a good one. Luckily, the SEC and CFTC already have the authority and expertise to regulate the market without new legislation, although the impermanent nature of these guidelines are still to be reminded upon. Ultimately, an Act similar to the Clarity Act, will present the final core of rules that govern the broader crypto landscape.
As promised, the SEC quickly reacted. On 25 September its Division of Corporation Finance updated its crypto FAQ, building on its interpretative release it published in March. Several questions around current token designs have been answered.
Once a network is functional, services to secure, maintain, improve or enhance it, including grants and work to grow network effects, would not count as managerial efforts which represent a part of the Howey test. Liquid stake tokens are now treated as digital commodities or tools rather than securities, as their value derives from the programmatic operation of the underlying system, while those issued by other providers fall under digital tools. Marketing of a network's existing uses, or even its future features, generally does not create an investment contract so long as it avoids promoting profit. What this means according to the SEC is that the teams can keep building after launch, and share revenue with token holders through buybacks, without risking dragging its token back into securities law.
Buyback programmes have gained popularity ever since the success of HYPE's token buyback model. Now, announcing a buyback programme for a token on an already functional network, definition which we have just discussed, would not by itself make the token a security.
The FAQ shows which direction the SEC wants to pursue, and that is in-line with the crypto industry's progress. The only issue remaining is how unclear some of the points are. The interpretative release accepts that governance tokens carrying votes on technical or governance matters can still be defined as digital commodities. What it leaves open are scenarios when a foundation holds a large share of the voting power, or a multisig able to upgrade the smart contracts of a functional network. DAO structures as a whole remain unclassified. The FAQ also measures functionality and decentralisation against the thresholds the issuer itself sets out rather than the SEC's definitions of thresholds. Most protocols today still have buybacks running with a team or foundation somewhere in the loop, and for now it seems they will have to judge which side they will sit on. This loose guidance does raise some eyebrows, and naturally causes concerns for crypto users looking forward towards getting regulated. One could argue these constructive rules, more akin to a safe sandbox, are a good opportunity to highlight the safety and robustness of crypto systems, and avoid future overregulation. If guidelines allow crypto participants to define the clear edges of the rules, in case of any type of collapse, it may give a signal to regulators to pursue stricter regulations, which could stifle crypto's growth and innovation capabilities.
The failure of the CLARITY Act leaves the question of how a decentralised venue can serve US users. Following the announcement of HIP-3* markets, Payward, Kraken's parent company, announced that it plans to offer US clients on-chain perpetual futures, starting with Hyperliquid. Under standard HIP-3, any deployer staking 500.000 HYPE can launch its own perpetual market on Hyperliquid's order book, open to any address. Hyperliquid has now proposed HIP-3*, an optional extension which adds deployer-controlled on-chain allowlists without affecting existing HIP-3 markets. Hyperliquid's on-chain order book would match and record the trades. The offering is subject to regulatory approval and no fee arrangement with Hyperliquid has been disclosed, but the value-add for both parties is clear. Hyperliquid holds the large majority of on-chain perpetuals open interest, and no registered US exchange or clearinghouse has yet deployed a market there. Still, Hyperliquid having the most open interest does not mean a lot if the HIP-3* market order books will be separated from the rest of the Hyperliquid's platform. The success of this partnership will ultimately depend on both parties' abilities to bootstrap markets anew.
Payward's position as that bridge was strengthened a week earlier, when Nasdaq agreed to invest $100 million in the company at a reported $21 billion valuation. The partnership extends Nasdaq's surveillance technology across Payward's venues, spanning crypto, equities, tokenised equities and derivatives, and targets the launch of Nasdaq Equity Tokens in the second quarter of 2027, connected to Payward's xStocks. US institutional exposure to Hyperliquid is also growing through more conventional channels: the three Hyperliquid ETFs launched between May and June held roughly $481 million in net assets by early September, and the first 13F filings show UBS and Jane Street among the holders, albeit nothing of significant size compared to their total assets, amounting to $50 million for top holders of the list.
Robinhood took the other route. At its annual event at the end of the month, it announced perpetual futures for eligible US users, offered by Robinhood Derivatives through Bitstamp, the digital asset exchange it acquired last year. The company also plans round-the-clock equities trading through an alternative trading system, pending regulatory review. For much of the year the market expected Robinhood's perps to arrive through Lighter, the perpetuals exchange it has a long-standing relationship with and which already serves as the official perpetuals partner on Robinhood Chain, the brokerage's Arbitrum-based network. Choosing its own licensed exchange instead most likely reflects the regulatory gap rather than a judgement on Lighter. Without a statute defining when a decentralised protocol may serve US retail directly, such as a CLARITY Act, an in-house venue under an existing CFTC licence is the path that can be approved.
Bitget suffered the largest reported theft of 2026, when an attacker took $388 million from the exchange's hot and warm wallets across several networks, including ETH, USDT, USDC, AVAX and BNB. The attacker did not compromise private keys. Instead, a vulnerability in a third-party security product used by Bitget gave them high-level internal credentials, which they used to send fraudulent withdrawal commands that the wallet system executed while bypassing its risk controls. Bitget suspects a sophisticated, state-backed group, with North Korean involvement under investigation but not confirmed. The exchange suspended withdrawals and resumed them in phases from 28 September, starting with bitcoin and ending with fiat and peer-to-peer transfers on 2 October. Its User Protection Fund, holding 5.500 BTC, will cover all losses, some of the stolen assets have been frozen with the help of industry partners, and a 5% bounty is on offer for recoveries.
Earlier in the month, the Liquid Network, the Bitcoin sidechain operated by Blockstream, lost roughly 4.000 BTC, worth around $320 million. A withdrawal of 4.000 L-BTC through SideSwap's peg-out service exposed a vulnerability in those bridge nodes, and the actors behind it, who described themselves as white-hat hackers in an on-chain message, asked Blockstream to patch every node before they would return the funds. After Blockstream confirmed the fix, they returned 3.400 BTC, about 85% of the total, but kept close to 600 BTC, worth around $47 million, which Blockstream has described as closer to extortion than a bounty.
The Ethereum Foundation published its tier list for Hegota, the fork planned for next year, evaluating 62 EIPs. Two received the S-tier, must-ship label, meaning the fork and its schedule are being built around them. First one focuses on the consensus layer, FOCIL (Fork-Choice Enforced Inclusion Lists, EIP-7805) addresses a centralisation problem which has grown since the Merge. Today a small number of specialised builders construct most Ethereum blocks, and a dominant builder can simply leave transactions out. FOCIL lets a committee of validators publish lists of valid public-mempool transactions which the block must include, so censorship no longer depends on the goodwill of whoever builds the block. On the execution layer, Frame Transactions (EIP-8141) make account abstraction native to the protocol. Smart-contract wallets currently rely on add-on standards and off-chain operators to bundle and sponsor their transactions. Frame Transactions instead split a transaction into programmable frames for validation, gas payment and execution, so wallets can use custom signature schemes, sponsored gas and batched actions directly. From here, A-tier proposals are committed unless delivery problems arise, while lower tiers ship only if time allows, and 28 proposals were declined outright.
The custom-signature point matters for their second announcement. The Foundation set December 2029 as the deadline for full post-quantum security across Ethereum's execution, consensus, and data layers, a target it calls non-negotiable. Native account abstraction is a precondition, as it allows users to move to quantum-resistant signatures without a new account type for every scheme. The timeline is demanding but one needed to provide assurance into Ethereum's safety.
Shortly afterwards, Vitalik Buterin laid out what comes after Hegota in an essay titled "The cryptographic world computer", describing Ethereum as a hybrid of blockchains and modern cryptography. Hegota is likely to be the last "normal" fork. Everything after it involves recursive STARKs, cryptographic proofs that verify other proofs, together with automated formal verification of client code, optimised consensus, and quantum safety. In practice, nodes would stop re-executing every block and instead sample data and verify a single succinct proof, and signatures would be aggregated off-chain into one per block. The targets for 2030 are 4 to 8 second slots and 8 to 32 second finality, against today's 12-second slots and finality of roughly 13 minutes. Buterin was explicit that the base layer will never match server latency and that infrastructure around it must close that gap, which keeps the L1 focused on verification and security rather than raw speed. The roadmap is ambitious, but it is now sequenced, with named proposals, a hard quantum deadline and a fork cadence the developers have committed to publicly. Also with Vitalik's essay to close the gaps in understanding of Ethereum's vision, Ethereum has a proposed path to being 'the world's computer', where all of the verifications of any computation could be securely executed on Ethereum.
Firelight raised an $8 million seed round to build insurance infrastructure for DeFi. The problem is one of scale and correlation. DeFi holds roughly $95 billion in total value locked, and only a fraction of one percent of it is protected by on-chain cover, partly because most cover pools are capitalised with the same DeFi assets they insure, so the capital meant to pay claims tends to lose value in precisely the moment it is needed. Another major reason for covers protecting such a small size of DeFi is due to its capital intensive nature. If covers are redeemed, it requires having a capital base ready to fulfil those claims. Firelight backs its cover with overcollateralized assets that have low correlation to DeFi markets, starting with staked XRP and expanding to BTC and XLM, creating an independent capital pool of substantial size behind protection for protocols and vaults against smart-contract risk and exploits. For institutions, credible protection of this kind is one of the conditions for committing capital on-chain at size, and the protocol and its first integrations are set to go live with leading crypto institutions and DeFi protocols in the coming weeks.
Another company which utilizes XRP, Doppler Finance, announced the TGE of its token XDP. Doppler Finance has been offering XRP holders few native ways to put it to work. Doppler's vault accepts deposits directly from the XRP ledger and returns yields in XRP itself, currently through strategies run with institutional custodians and selected centralised platforms. The roadmap extends the same product on-chain, starting with Coinbase wrapped XRP on Base.
Atum emerged from stealth with a $13.5 million seed round and opened its network to builders. This month's stablecoin news illustrates the problem Atum is trying to address. More issuers, more chains, and more local rails mean every payment company has to integrate bilaterally with each one, and every handoff adds costs and delays to transactions. Atum acts as a coordination layer which does not issue a currency, operate a blockchain, favour a rail or take custody of funds. A sender specifies what they will pay, the recipient specifies what they want to receive, and settlement providers compete to fulfill each payment, alongside native authorisation, reversibility and identity verification built in.
Within the RWA space, Tenka closed a $2 million pre-seed round to build on-chain infrastructure for asset-backed finance. Private credit investors who need to exit early are limited to bilateral sales and fund redemptions. Large managers have over years increasingly restricted withdrawals, leaving investors stuck in positions often until maturity. Tenka connects the full lifecycle of instruments backed by consumer loans, business receivables, and equipment leases. In tandem with these instruments, Tenka provides transparent collateral data, and a secondary market where exposure can change hands while the underlying assets mature normally. This allows easier integration of such instruments with the wider DeFi, and now originators can gain access to pools of capital on-chain previously out of reach.
In the prediction market space, functionSPACE raised a $1.7 million pre-seed round to build primitives for pricing outcomes. Currently, prediction markets work on a binary basis, where a market can only possess two outcomes. The most economically interesting questions come in the form of numbers, such as an inflation print, an interest rate, or a company's earnings. So far, binary markets have tried to address these questions by separating markets into many separate yes-or-no buckets. In result, this segregated the markets and made market liquidity bootstrapping even more difficult. FunctionSPACE prices the whole distribution instead, so a single market produces a full probability curve and concentrates liquidity where traders actually disagree.
