Total crypto market capitalization is holding near $2.9–3.0 trillion as the week opens, with Bitcoin pulling back from $87,000 toward $84,000 while altcoins keep pace: the capitalization of the sector including Ethereum has risen more than 45% since June. The decisive driver of the week is institutional rather than retail. Spot Bitcoin ETFs absorbed roughly $2.4 billion in a single week, flipping 2026 year-to-date flows back into positive territory after a deficit that had stretched back to 13 July. Around that, the picture is mixed: Washington stumbled on its flagship crypto bill, states kept legislating on their own, one of the largest exchanges reported the year's biggest hack, and the core networks spent the day moving their roadmaps forward.

Institutional demand returns with force

The twelve US spot Bitcoin ETFs took in about $2.39–2.4 billion of net inflows in the week ending 25 September, the strongest weekly result since October 2025. Monday alone accounted for nearly $999 million to $1 billion in a single day, the best session since 6 October 2025, with BlackRock's IBIT taking $1.2 billion for the week and Fidelity's FBTC about $702 million. Total assets under management reached roughly $108.4 billion, with cumulative inflows since launch near $57.6 billion.

The more important detail is what happened to the annual picture. On 13 July, year-to-date flows stood at a deficit of roughly $5.5–5.8 billion; as of this week, estimates from different sources put the year in positive territory — roughly $800 million, $925 million and $934 million depending on the tally. CryptoPotato and Bitcoinist describe the reversal, with BTC-ECHO covering the same inflows in German. The return of this kind of institutional demand moves the market out of a correction phase and back into an accumulation phase, feeding directly into BTC price and into liquidity for the rest of the market.

That demand did not stop at Bitcoin. Seven spot Solana ETFs took in $188.21–188.22 million on the week — the largest result since launch, and second only to the $199.21 million launch week in October — with Bitwise's BSOL capturing about $128.46 million, or 68% of the total. Cumulative Solana ETF inflows hit a record $1.61 billion, of which Bitwise accounts for $1.22 billion, alongside the biggest single-day inflow recorded since October 2025. XRP ETFs added $75.89 million on the week, extending their inflow streak to ten consecutive weeks and pushing cumulative investments to a record $1.79 billion, with Bitwise at $677 million. Ethereum ETFs took roughly $690 million, for $13.94 billion cumulatively. U.Today and CryptoPotato both frame this as institutional demand broadening well past the largest asset.

NEAR is the newest addition. On 24 September, NYSE Arca approved the listing application for the Bitwise NEAR ETF under ticker NRR, and the SEC confirmed that the Form 8-A registration had taken effect; trading is expected to open around 29 September. The fund is structured to fully stake its NEAR position for yield, and its European sibling, the Bitwise NEAR ETP, has already passed $100 million in assets under management. NEAR jumped 13.9% on 25 September to $5.42, extending a ten-day rally of roughly 130% from a $2.34 base, with NEAR Intents volume reported at $29.9 billion. The momentum is stretched by any technical measure — RSI at 87.05, Bollinger %B at 95.5%, with resistance cited at $5.70 and $5.98. Blockchain.News pairs the ETF catalyst with that overbought ceiling, while Bitcoin.com News notes NEAR among altcoins outpacing Bitcoin on the week.

Corporate treasuries moved in the same direction. After a two-week pause, Strategy bought 950 BTC for $75.7 million at an average price of $79,670, taking its holdings to 846,000 BTC for about $63.8 billion. Riot Platforms, meanwhile, fully repaid the outstanding balance and interest on a credit line of up to $200 million from Coinbase Credit, releasing collateral held in BTC, USDC and cash. The facility carried an interest rate below 6.15% and was not due until 20 April 2027, and the early payoff carried no penalty. As of 30 June, Riot held 11,380 BTC, of which 5,821 were pledged — more than half its position. Cointelegraph and Crypto News Flash cover both sides of that balance-sheet story.

Altcoins find real institutional use

Quant's QNT was the standout mover, and the reason is concrete. The Clearing House selected Quant's technology for its On-Chain Money Initiative, settling tokenized deposits with connectivity to the RTP and CHIPS networks, with an institutional launch expected in the first half of 2027. QNT gained anywhere from 39% to 75% in a day depending on the measurement window, and roughly 170–185% over the week, with price cited around $160–190. Active addresses jumped from 870 to 2,064 on 24 September, close to a one-year high, against a backdrop of The Clearing House networks settling more than $2 trillion daily in the US. CryptoPotato and Bitcoinist document the spike and its cause. An entry into the infrastructure of a systemically important US payments operator changes what an altcoin can be worth over a cycle.

CME Group confirmed the launch of Uniswap futures on 19 October, subject to regulatory approval: standard contracts on 10,000 UNI and micro contracts on 1,000 UNI. UNI rose more than 15% to $10.88 before retreating to $10.04. The five futures contracts CME added in 2026 have now generated more than $1 billion in combined notional, and Uniswap processed 140 million swaps in August, with roughly $26 billion flowing through Robinhood Chain. Blockchain.News covers the announcement and the immediate fade.

Payward, the operator of Kraken, reported second-quarter 2026 adjusted revenue of $508 million, up 17% year over year, with adjusted EBITDA of $23 million. Trading volume on the platform fell 18% year over year to $310 billion as spot activity cooled, while the number of funded accounts reached a record 6.6 million holding $40 billion in assets. Nasdaq Ventures agreed to invest $100 million at a $21 billion valuation, extending work on Nasdaq Equity Tokens with a launch in the second quarter of 2027. The company said it expects to buy a bank in Europe soon without naming a target, and does not expect an IPO before the second quarter of 2027; its draft registration was filed with the SEC in November 2025, and the Bitnomial deal of up to $550 million closed on 1 May, alongside completed deals with Magic Labs and Reap. Crypto.News lays out the expansion plan.

Washington stalls while the states keep legislating

The US Senate rejected the Digital Asset Market Clarity Act on a decisive procedural vote on 15 September 2026, 49–50, despite the House having passed the bill 294–134 in July 2025. Reporting points to a contested ethics amendment concerning Donald Trump's crypto ties as a central factor, after a June financial disclosure in which Trump revealed $1.4 billion in income from crypto businesses. Senators Gallego and Schumer said the bipartisan deal had been killed, and negotiations with Senator Tillis on 15 September were halted by a staffer for Tim Scott. Senator Hagerty left open the possibility of resuming work after the elections. The collapse is also partly linked to the withdrawal of support by Brian Armstrong and a dispute over stablecoin yields. A CoinDesk poll found that only 1% of registered voters consider crypto their top problem. CoinDesk traces how months of negotiation unraveled, and Crypto Briefing covers the political-influence angle. The failure postpones regulatory clarity and leaves the SEC and CFTC with more room to act.

On 25 September, the SEC's Division of Corporation Finance issued a set of frequently asked questions. Announcements of token buybacks by crypto networks that are already operating are not treated as a promise of essential managerial efforts under the Howey test, while for networks that do not operate, buybacks as a revenue source may run afoul of the rules. The guidance draws a conditional line: a qualifying staking receipt may be a digital instrument, whereas the protocol's liquid staking token may be a digital commodity. The FAQs carry no legal force, rest on the SEC's March interpretive release, and do not classify specific tokens by name — cbETH and stETH were not addressed. MetaLeX Labs' general counsel called the guidance a loophole and allowed that a future SEC could overturn it. The timing, one day after the Clarity Act defeat, was not accidental. Decrypt and CryptoSlate cover both the buyback ruling and the staking split.

States filled the gap. On 27 September, California Governor Gavin Newsom signed AB 2409, banning state and local officials from issuing and promoting memecoins, and barring digital platforms from offering such tokens to state residents. The Senate passed the bill 40–0 and the Assembly 78–0; the author is Assemblymember Avellino Valencia. Platform-side restrictions take effect on 1 January 2027. The rules cover elected and appointed officials, legislators and advisory board members, and liability is civil only, with state attorneys general and local prosecutors able to seek an injunction and disgorgement of profits. The law names no specific token, is not retroactive, and does not ban memecoins such as Dogecoin. U.Today, Crypto Briefing and Crypto News Flash give the vote counts and the scope.

Stablecoin rules advanced on two fronts. On 24 September the Federal Reserve Board requested comment on two proposals implementing the GENIUS Act: full reserve backing, plus standardized capital and risk-management requirements for Board-supervised stablecoin issuers, and a procedure for stablecoin issuance by bank subsidiaries. Governor Michael Barr stressed that stablecoins must remain reliably and promptly redeemable at par even under stress. Separately, on 23 September, Federal Reserve Financial Services said FedNow is preparing for cross-border transactions and an expanded ISO 20022 standard; in April the Board had proposed amending Subpart C of Regulation J to allow the use of intermediaries. Crypto News Flash details both. These are the first concrete rules of treatment for stablecoins from the Fed, and they will shape the competitive structure of USDT and USDC.

Tether disclosed that its exposure to EQIBank is below 0.034% of the group's assets, without disclosing the exact figure or confirming any link to USDT reserves. Bitcoinist estimates that caps the exposure at roughly $64 million against a $187.75 billion asset base. US authorities are seeking forfeiture of about $83 million in bank accounts and some 1.18 million USDT in the case against payment processor Capstone Limited, while EQIBank put the affected amount at roughly $89 million and warned of operational strain. EQIBank's motion for return of property was denied, and no final decision has been made. Tether said it has not interrupted USDT issuance or redemption; Tether International reported $187.75 billion in assets against $183.64 billion in liabilities as of 30 June. CryptoSlate and Bitcoinist cover the disclosure. A counterparty of that size sitting inside a seizure case is a settlement and confidence risk for USDT, however small the share of reserves.

Adoption data from Visa's Money Travels 2026 survey points in the same regulatory direction. Fifty-six percent of Americans said they would use stablecoins with bank-grade fraud protection and deposit insurance, against 36% without such guarantees; in Latin America the figure with guarantees reaches 74%. The survey covered 2,192 US adults and 45,445 people across 20 countries, and the guarantees described were hypothetical — no stablecoin is currently insured. Fifty-six percent of respondents had never heard of stablecoins at all. Dollar-denominated stablecoins in circulation stand at roughly $312 billion, with USDT at $184 billion and USDC at $76 billion. CryptoPotato reports the findings: the barrier to mass adoption is not technology but the absence of guarantees.

Ethereum redraws its roadmap

Vitalik Buterin published an essay, The cryptographic world computer, describing Ethereum as a hybrid of blockchain, cryptographic proofs and distributed off-chain computation, with an architecture laid out through 2030. The Hegota hard fork planned for 2027 will, in his view, be the last normal fork; after that, upgrades will rest on recursive STARKs, formal verification and post-quantum protection. Announced improvements include FOCIL for censorship resistance, EIP-8288, Lean consensus and better state management, and he expects balance queries, payments and spending rules to be hidden — with payment finality in the 8–32 second range. The essay also references a Shielded Bitcoin design drawing on Zcash's work. CoinDesk, The Defiant, U.Today and Crypto.News all trace the shift from a public blockchain to a private computing network — a change in paradigm that sets the direction for the second-largest crypto asset for years.

On the near-term schedule, Ethereum Foundation researcher Tony Warstalletter said the Glamsterdam upgrade and EIP-7928 (Block-Level Access Lists) are close to completion, with a Sepolia fork set for 6 October 2026 and mainnet activation expected in the fourth quarter of 2026 — no official date yet, with testing continuing on devnet. The goals are parallelization and faster processing, greater throughput and protection against database bloat, while ePBS reworks the block validation pipeline to reduce trust assumptions. Glamsterdam is the fork after Hegota. U.Today lists the dates to watch.

DeFi collateral, governance and stalled upgrades

Aave opened a new collateral class on Base on 25 September: tokenized equities AAPLc, AMZNc, GOOGLc, METAc, MSFTc, NVDAc and TSLAc can be posted as collateral, with USDC as the only borrowable asset. The borrow cap for the Magnificent Seven basket is $21 million, and the USDC supply cap is $32 million. LTVs across the seven tokens run 65–79%, with liquidation bonuses of up to 5.5%. The structural risk sits in the price feed: Chainlink equity feeds run from Sunday 20:00 to Friday 20:00 Eastern and hold the last value outside those hours, so a position can cross the liquidation threshold without any visible price update. The market was activated directly by the Protocol Security Council rather than through an AIP or Governance V3 vote, even though Aave Labs had previously announced a Snapshot vote as a prerequisite. CryptoSlate spells out the weekend gap exposure for USDC lenders.

Lido DAO proposal #214 passed with the support of 58.2 million LDO, activating Dual Governance V1 parameters on Ethereum mainnet. stETH holders gain a mechanism to challenge or delay individual governance actions without reversing the LDO vote itself, and the emergency governance delay window was extended to 14 days. Bitcoinist covers the result. Dual governance redistributes control over the largest staking protocol, with direct read-through to ETH and stablecoin risk inside DeFi.

Elsewhere, upgrades slipped. The XRP Ledger delayed activation of its Batch upgrade for a second time, from 29 September to at least 9 October 2026, after validator agreement fell below the required 80% over a two-week window; an earlier version of the upgrade had been withdrawn over a critical bug. PermissionDelegation was pushed to at least 8 October. Batch is meant to allow payment and transfer of tokenized assets simultaneously. BTC-ECHO covers the delay. On Solana, proposal SIMD-0649, which would have required validators to reject blocks whose transactions were not ordered by non-increasing fee priority within a batch, was closed without merge on 25 September following a call for broader discussion. The proposal never imposed a single queue for a full slot — leaders still chose transactions and batch boundaries, and ordering at equal priority stayed arbitrary — and full-batch verification conflicted with Firedancer's partial-replay practice, so comparison was allowed as transactions arrive. CryptoSlate notes that MEV and slot-leader discretion remain unconstrained.

Security: a week of exposures and a precedent

The week's largest story on the risk side is the exchange incident Bitget has described as the year's biggest hack. According to the exchange's own disclosures and the third-party on-chain trackers cited in reporting, the damage estimate was raised from $351.6 million to about $387.5 million — attributed to the inclusion of transfers in Zcash and TRON rather than to a new wave of attacks. GoPlus Security was cited as saying attackers did not obtain private keys but instead compromised the wallet backend and falsified transaction data, with cold wallets untouched. The assets involved include XRP, ETH, USDT, ZEC, USDC, USDT0, XAUt, BNB, AVAX and TRX; the largest single transfer was about $185 million within a minute, and Bitquery put the stolen XRP at roughly 102.98 million tokens. Bitget said the vulnerability was fixed and set a staged restart of withdrawals: BTC on 28 September, ETH on 29 September, USDT on 30 September, and other tokens, fiat and P2P on 2 October. AMLBot traced around 4 BTC through Wasabi CoinJoin, and roughly $343 million was assessed as still sitting in 13 attacker wallets as of 25 September. Because much of this detail originates with the exchange and with tracking services rather than independent forensic work, the figures are best treated as provisional. Crypto News Flash, NewsBTC, CryptoSlate and BTC-ECHO cover it. The case is the year's largest, and it questions hot-wallet security at exactly the moment institutional balances are growing.

In the Cosmos ecosystem, validators set a precedent. A governance attack on Neutron on 22 September handed an attacker administrative control over the Astroport contracts, and about 1.73 million ATOM moved out. Cosmos Hub validators halted the chain at height 33,086,740 and restarted it with patched Gaia v28.3.0. A one-time state change moved 1,227,121.37 ATOM from the attacker's address into a recovery multisig, with the Hub itself never exploited. Releasing the funds requires a separate governance proposal: as of 26 September no mandate had been granted to the multisig, and proposal 1056, ATOM Refund & Justice Bounty, was still being voted on. Roughly 500,000 ATOM had been swapped through THORChain before the halt, and a further 168,990.9 ATOM passed through THORChain after the restart. CryptoSlate covers the interception — the first case of validators effectively seizing funds from an attacker, a new recovery model for the ecosystem.

Reported as part of the Bitget fallout, Bitget's CEO Gracie Chen publicly demanded that THORChain block addresses linked to the exchange's hackers, and the protocol declined, citing an admin key it retired in February 2025. According to accounts published this week, the flagged address swapped XRP for bitcoin after the request was made. Chen had earlier linked the investigation to VPN services used by a North Korean hacker group; THORChain disputes such comparisons, including through a representative of OKX. RUNE rose roughly 50% over the week on the news. The Defiant and Crypto.News cover the clash, which highlights how little leverage any single participant has over routes designed to be unblockable.

Two quieter items on Bitcoin infrastructure. Core Lightning released version 26.06.7 fixing a vulnerability that let a node treat a spend of a revoked commitment as a cooperative close when the outputs matched previously recorded shutdown scripts; exploitation required opening a channel without a predefined upfront shutdown script. The patch checks locktime and transaction sequence encoding before analyzing outputs. Bitcoin Optech described the patch on 25 September, and the project strongly recommends updating to 26.06.8, released 22 September, because Docker images tagged v26.06.7 did not contain the fix. The issue concerns Core Lightning's channel handling rather than Bitcoin consensus rules. CryptoSlate has the details — the bug allowed operators to dodge the Lightning penalty for cheating, which touches settlements and incentives across the network.

Separately, BIP138 was merged into the Bitcoin Improvement Proposals repository on 21 September and remains in Draft status. It describes an encrypted backup file holding descriptors, wallet policies and metadata outside the seed phrase, with key material required to be deleted before encryption. The holder of a matching xpub from a backup wallet can decrypt the file without the seed, exposing public keys and script structure without obtaining signing rights; the main risk concerns an xpub disclosed before a multisig wallet was created, for example by a server that already knows the account xpub. CryptoSlate notes this is a conditional exposure rather than a reported compromise.

A macro warning from Apollo

Torsten Sløk, chief economist at Apollo Global Management, published a note titled Is an Agentic Bank Run Coming? on 27 September, describing the risk of automated deposit flight into fintech. The average US checking account rate is 0.1% according to FDIC data, against 3.3–5.0% offered by fintechs: Adelfi at 5.0%, SoFi at 4.5%, LendingClub LevelUp at 4.2%, Pibank at 4.1% and Revolut Standard at 3.5%. Cheap deposits are the funding base for mortgages, auto loans and corporate credit lines, so a mass outflow would transmit well beyond deposit-taking. Sløk cited AI products for cash optimization, including Muse from Meta, and noted that the Bank of England is separately concerned about herd behavior by AI systems in financial markets. Crypto Briefing and The Daily Hodl cover the note. If cash-optimizing agents really do migrate balances, the macro backdrop for risk assets, crypto included, changes.

Put together, the day describes a market where capital is arriving faster than rules are. Institutional flows have flipped the year positive across Bitcoin, Solana, XRP, Ethereum and NEAR, treasuries are adding and unleveraging, a systemically important payments operator has chosen a crypto network for settlement, and regulated futures are spreading to DeFi's largest token. Against that, Washington's flagship bill died on a procedural vote, the SEC answered with guidance rather than legislation, California legislated on its own, the Fed began writing stablecoin rules, and the year's largest exchange hack laid bare a security layer that has not kept pace with the balances now sitting on-chain. Flows set the price; the unresolved questions are who writes the rules and how much of the infrastructure holds.