SEC and CFTC Move Ahead on Crypto Rules as CLARITY Act Stalls
Regulation
After the U.S. Senate failed to advance the CLARITY Act, both the SEC and the CFTC signaled they will proceed with crypto rulemaking under their existing statutory authority. SEC Chairman Paul Atkins said the Commission will act decisively within its statutory authority to deliver certainty for American investors, while CFTC Chair Mike Selig said his agency is ready to ship its rules for the new frontier of finance. This builds on the SEC’s August proposal, Regulation Crypto Assets, which creates a tailored securities offering regime for token issuers and extends the token taxonomy established in the Commission’s March interpretive release, distinguishing digital commodities, digital collectibles, digital tools, payment stablecoins and digital securities. For institutions, this means the path to digital asset compliance will increasingly be defined by agency rulemaking rather than by Congress, and compliance teams should track the rulemaking docket rather than wait on legislation.
Security
On September 15, an Ethereum Safe wallet holding leveraged rsETH lost roughly USD 7.8 million. The root cause was a custom Safe module that exposed a public entry point, accepted caller-controlled data and performed a DELEGATECALL without any access-control check, letting an external attacker execute code in the wallet’s own context. Because the module had already been authorized by the Safe, the attacker effectively inherited the wallet’s full permissions. In an unusual turn, an MEV bot front-ran the attack in the same block and captured the entire amount. KelpDAO confirmed its core contracts were unaffected and the rsETH pool remains fully collateralized. These access-control weaknesses are now the leading source of DeFi losses: of roughly USD 1.3 billion lost across 2026, the dominant cause has shifted from contract-logic bugs such as reentrancy, flash loans and oracle manipulation toward key management and permission misconfiguration. For institutions, MPC self-custody solutions split signing authority across multiple parties and enforce transaction policy before signing, structurally removing the scenario in which one compromised module or key drains everything.
Markets
The Federal Reserve raised rates by 25 basis points on September 16 in a unanimous vote, lifting the target range to 3.75%–4.00% — its first hike since July 2023. The crypto reaction was muted: BTC traded between roughly USD 75,000 and USD 76,500 after the decision and settled near USD 75,600, while ETH swung between USD 2,370 and USD 2,430 before closing near USD 2,376. Earlier that morning BTC had opened 3.3% lower day-over-day and ETH 4.6% lower, pressured by both the legislative setback and hike expectations. Altcoin performance diverged, with XRP up about 1.5%, SOL up 1% and ZEC standing out at 6.5%. Because a 25 basis point move had been heavily priced in beforehand, the decision itself produced little volatility.
International
Japan’s Financial Services Agency amended Payment Services Act rules to recognize certain foreign trust-type stablecoins as electronic payment instruments, allowing stablecoins based on trust beneficiary rights issued by overseas trust banks to be handled domestically by registered electronic payment service providers — a further step toward alignment with the EU’s MiCA and toward cross-border interoperability. Seven of the nine major jurisdictions now have stablecoin frameworks in force. As requirements for reserve adequacy, independent audit and issuer licensing converge globally, AML compliance capability is becoming a gating requirement for cross-border digital asset business rather than a differentiator. Separately, the European Blockchain Convention opened in Barcelona with institutional participants, not retail narratives, taking center stage.
Other
CoinEx announced an orderly wind-down on September 15 after nearly nine years of operation. Under its published timeline, new registrations closed and futures moved to reduce-only on September 15; margin, loans, staking and Earn close on September 22; all spot pairs and the CoinEx Smart Chain shut down on September 29; and withdrawals remain open until December 22, with the exchange reporting a reserve ratio above 100%. It follows BitMEX and BitMart in exiting, reflecting the same three pressures on mid-tier venues: weaker retail spot activity, thinner long-tail liquidity and rising compliance overhead. The continued contraction of trading venues is a reminder for institutions to reassess counterparty exposure and keep assets within a institutional-grade custody security perimeter they control, rather than leaving balances parked on third-party platforms.
About Safeheron
Safeheron is a security infrastructure provider focused on institutional-grade digital asset custody. Built on MPC (multi-party computation), it gives exchanges, market makers, funds and enterprise clients seedless private key management with no single point of failure, alongside risk controls that let them manage digital assets securely and within their compliance obligations. The team is made up of engineers with long-standing backgrounds in cryptography and financial security, and tracks global regulatory and security developments continuously to support institutional clients on custody security and compliance.
