Bitcoin began the fourth quarter roughly where it spent much of the previous one. After briefly pushing above $85,000 and touching around $85,500 following a softer-than-expected US inflation reading, the asset slipped back toward $83,700–$84,000 and settled into its old $82,000–$85,000 range, trading near $83,500–$84,000 in Asian hours on October 1.
The reason the rally faded is straightforward: the bond market refused to cooperate. Ten-year Treasury yields touched5.342%, the highest since April 2002, before easing to roughly 5.251%, while 30-year yields reached 5.62%, a level not seen since 2002 either. Spot bitcoin ETFs, notably, offered no support in the first session of the quarter.
Around that price action, the day's news agenda was unusually crowded. Security losses reached a yearly high, Washington's SEC moved to clarify who may legally hold client crypto, Europe's regulators kept tightening the pressure on the largest exchange operating there, and institutional flows continued to build.
Macro Backdrop: Fed Patience Meets Record Bond Yields
Federal Reserve Governor Philip Jefferson said further policy adjustment should follow a careful reading of the data and may require more time, pointing to the rise in yields across the curve since the September FOMC meeting.
His comments landed as prediction market odds of an October rate hike fell to 23%, down from a peak of 70% earlier in the week, with a hold priced at 77%. The Fed raised rates for the first time since 2023 in September, and the soft PCE print on September 30 pushed Goldman Sachs to move its call for the second hike to December.
August PCE came in at 3.4% year over year and 3.0% excluding food and energy, below expectations. Kashkari, head of the Minneapolis Fed, said he remains open to action in October while expecting further increases next year. For crypto, the practical reading is that liquidity expectations now swing on every inflation print and every Fed appearance.
Security: Worst Month of 2026, With Quarterly Losses Above $1.26 Billion
September was the worst month of 2026 for the industry by dollar losses. PeckShield counted 55 major incidents and roughly $766.5 million in losses; CertiK tallied 97 incidents and $768.4 million. Quarterly losses in Q3 reached $1.26 billion, and CertiK puts total 2026 losses at roughly $2.68 billion across 656 incidents.
- Bitget confirmed that roughly $387.5 million was moved to the attacker's addresses after hot and warm wallet compromise on September 24. The exchange restored BTC, ETH and USDT withdrawals, showed a 131% reserve ratio, and topped up its protection fund by more than $300 million on September 30.
- Liquid Network lost around 4,000 BTC after a rangeproof cache bug. The attacker returned 3,400 BTC on September 7, leaving roughly 602 BTC unreturned.
- NEAR Intents lost about $3.8 million to a vulnerability in the Omni infrastructure handling deposits and withdrawals. Cross-chain services were suspended on 11 networks including BSC, Polygon, TON, Optimism, Avalanche, Stellar, Monad, Scroll and Plasma. The protocol says it will fully reimburse affected users and has notified law enforcement. NEAR fell from $5.10 to about $4.79 in the first minutes after disclosure, down roughly 7.5–8% over 24 hours. Days earlier, NEAR Intents had frozen $503,000 of roughly $50 million stolen in the Bitget hack, which drew fresh criticism about the protocol's role in laundering.
- Drift opened claims for its DFX recovery token after the April 1 exploit, which confirmed losses of roughly $295.4 million. The recovery pool holds about 3.11 million USDT against an issuance of roughly 299.5 million DFX, implying a payout rate near one cent per dollar of loss for qualified wallets. Settlement burns tokens, the claim window runs until 00:00 UTC on January 1, 2028, and the pool is funded by a share of Velocity's daily net revenue plus funds committed by Tether of up to 127.5 million USDT. Drift says the April incident was a multi-month social engineering campaign rather than a smart contract bug.
MetaMask also disclosed a security incident affecting part of its infrastructure and began withdrawing affected non-custodial staking validators as a precaution. The company said no direct threat to wallets or user funds was identified. Researcher Kaden estimated that a reward payout of about 0.36 ETH was redirected to an address funded through Tornado Cash, and put the affected exit at roughly 17,000 validators holding some 523,000 ETH, though MetaMask itself has not confirmed those figures.
Lido confirmed that MetaMask Staking is exiting the protocol's validators, with completion expected by October 7 and a full ETH return cycle of up to 45 days. The network's exit queue grew from roughly 200,000 ETH to more than 700,000 ETH, and withdrawal wait times stretched from about 3.5 days to nearly two weeks. Given the unconfirmed nature of the loss estimates, the scale of the withdrawal is the more solid signal.
Institutional Demand: Citi's Target Hike and a $6.3 Billion Quarter for ETFs
Citigroup raised its 12-month bitcoin target from $82,000 to $113,000 — an increase of about 38% — and lifted its ether target from $2,240 to $3,028, or 35.18%. The September 30 note is tied to renewed ETF inflows, with spot bitcoin ETFs posting a nine-day streak of roughly $3 billion.
Citi models about $5 billion of crypto inflows over the next 12 months, driven by gradual growth in adviser and brokerage exposure. The bank attributes the revision to the rally, a weaker dollar, and moves by the SEC and CFTC that partly offset the CLARITY Act's failure in the Senate on September 15. Bitcoin gained roughly 40% over three months and ether about 68%, cutting year-to-date losses to approximately 4% and 9%.
Notably, Citi does not expect a new all-time high for bitcoin within 12 months, projecting one only in the third quarter of 2027.
Quarterly ETF data reinforce the picture: spot bitcoin ETFs took in roughly $6.3 billion in Q3 2026 as bitcoin rose nearly 43%. September added about 8% while the S&P 500 was nearly flat and gold fell more than 6%. Corporate buying added to the flow, with Strategy adding 4,603 BTC for roughly $369.7 million in September and Strive acquiring 1,107 BTC for $94.5 million. It was bitcoin's best quarter since 2024.
Pressure is also visible in Strategy's capital structure. The company has spent $1.28 billion of its $2 billion STRC buyback fund in ten weeks, leaving less than $724 million. It repurchased 13.3 million STRC shares, about one eighth of the float, at an average of $98.86 last week, up from $86.52 in late July. STRC itself opened at $99.18 after trading in the $70–80 range. The board approved a $1 billion fund on June 29 and raised it to $2 billion by September 8, and the buybacks were funded largely by diluting MSTR common shares, which sit below STRC in the capital hierarchy.
XRP: A Nasdaq Treasury and a $1 Billion Unlock
Shareholders of Armada Acquisition Corp. II approved the merger with Evernorth at an extraordinary meeting on September 30 with 94% of votes cast and about 69% turnout, clearing the path for a Nasdaq listing under the ticker XRPN starting October 8. The deal is expected to close October 7.
At closing, Evernorth expects to hold at least 473,276,430 XRP, which it says would make it the largest public company with a pure XRP treasury. The deal and related private placements raised more than $1 billion, including about $300 million in cash — $225 million from private placements, $30 million in convertible notes and roughly $48 million from the SPAC trust. Named backers include Ripple, Kraken, Pantera Capital, SBI Group, Arrington Capital and GSR. At a price near $1.50, the treasury is worth roughly $710 million.
Supply dynamics moved in the opposite direction on October 1, when Ripple released 1 billion XRP from escrow in four transactions of 100 million, 300 million, 400 million and 200 million XRP. The largest tranche landed at 00:00:02 UTC, and the release was valued at about $1.49 billion against trading near $1.48–1.50 and a market cap above $93 billion.
US spot XRP ETFs took in $121.4 million in September per SoSoValue, bringing cumulative inflows since launch to roughly $1.79 billion. Analysts cited $1.54 as the hourly breakout level with a target near $1.70, and noted sell walls up to $1.70 and resistance at $1.54–1.56.
Regulation: SEC Custody Rules, EU Pressure on Binance, and Stablecoin Pushback
The SEC published a roughly 760-page proposal, filed under number S7-2026-35, that would open a limited self-custody path for investment advisers and registered funds. Self-custody would generally be permitted when a qualified custodian is unavailable, provided the adviser has the necessary expertise and reviews the arrangement quarterly, and the proposal would let state-registered trust companies act as custodians for client and fund assets. The document also formalizes earlier staff guidance from September 30, 2025 and a December 2025 statement, clarifies accounting, financial statement audit and broker-dealer custody requirements, and opens a 60-day public comment period after Federal Register publication.
In Europe, the regulatory picture is tightening rather than loosening. According to the Financial Times, citing informed sources and not confirmed by the regulators, ESMA and the authorities in France, Germany and Greece have begun examining whether Binance may keep serving EU customers under the reverse-solicitation exemption without a MiCA licence. Licensed firms were supposed to begin winding down EU operations on July 1 after Binance failed to secure authorisation this summer. Binance said in June it had been in talks for roughly 18 months without a formal refusal, then withdrew its Greek application. Separately, ECB President Christine Lagarde personally asked the Greek prime minister to block Binance's application, with money laundering admissions and concerns about dollar stablecoin growth amid digital euro development cited as reasons. ESMA has also called for expanded MiCA powers for national regulators, including asset freezes where criminal linkage is suspected.
Stablecoin rules are drawing pushback from both the industry and the public. Stand With Crypto EU said more than 50,000 signatories wrote to the European Commission during the MiCA review asking to let regulated issuers offer cashback, loyalty programmes and fee discounts, while over 126,000 people signed the group's petition for a lighter touch on crypto regulation. That response outnumbered the ECB's digital euro consultation (8,221 replies) and the Commission's 2020 crypto consultation (198 replies). On September 22 the ECB proposed extending the ban on yield to lending, borrowing and staking, and replacing bank reserves with liquidity thresholds, citing the mismatch between 24/7 stablecoin settlement and reserve assets that move on a traditional schedule.
Circle's EU strategy director Patrick Hansen said only three of the top 30 global stablecoins currently comply with MiCA — USDC, USDG and EURC — while roughly 30 e-money tokens have been approved in Europe. Circle is asking to preserve multi-issuance so an EU-licensed structure can issue alongside affiliated entities in other jurisdictions, and wants reserve requirements revised; the rule requiring 30% of reserves in bank deposits, rising to 60% for significant issuers, should be replaced with a liquidity-quality approach and an equivalence regime for foreign issuers. EURC circulation has more than doubled year over year to roughly €400 million.
Other regulatory moves across the day:
- Illinois agreed in court to delay its 0.2% crypto transaction tax from January 1 to July 1, 2027, subject to court approval, as Digital Chamber, the Illinois Chamber of Commerce, the Illinois Blockchain Association and the Crypto Council for Innovation continue to challenge it on constitutional grounds. Signed by Governor J.B. Pritzker in June as part of the state's fiscal 2027 budget, the tax required brokers to withhold 0.2% or face prison terms and fines, with no de minimis threshold. The delay was structured as a stipulation so as not to preempt the court's ruling.
- NYDFS and the Wyoming Division of Banking signed a memorandum covering companies already operating in one state and applicants seeking licences in both. It provides for sharing supervisory exam data, coordinating schedules, joint exams and notice of potential enforcement action, plus a fast track: firms with at least three years under supervision without enforcement action may get a decision in the second state within six months. Each state retains approval authority, and the memorandum links New York's BitLicense regime to Wyoming's crypto statutes and bank charters.
- The CFTC sent two rulemaking actions to OIRA on September 28 — a proposal to further define swaps to include event contracts (RIN 3038-AF82) and an interim final rule excluding gaming-like products (RIN 3038-AF81). Neither was published or effective as of October 1. The moves come after the Sixth Circuit ruled on September 25 that the contested sports contracts at issue are not swaps, reversing the Tennessee decision. CFTC reported in March that DCM operators certified about 1,600 new event contracts in 2025, versus roughly five per year in 2006–2020, and New York is pursuing its own case against Polymarket.
- A Congressional Research Service report on CLARITY Act (H.R. 3633) released September 30 found the Senate-approved version would let all insured depository institutions and credit unions engage in 11 specified crypto activities, including digital asset underwriting and trading, which CRS says goes beyond what banks can do in comparable traditional markets. The House had passed a broader version, but the Senate's September 15 floor vote failed 49–50 against a 60-vote threshold. The GENIUS Act has already allowed bank units to issue and custody stablecoins.
- Federal Judge Jennifer Rochon dismissed with prejudice the Burwick Law class action over the LIBRA and M3M3 memecoin launches, ruling that six months of token activity cannot support a RICO claim and that Meteora was not properly named. Plaintiffs Omar Herlock and Anuj Mehta were denied leave to amend as futile, and three defence motions were granted. Nansen Research estimates 86% of LIBRA investors lost more than $250 million. Attorney Ariel Giver said the ruling does not mean memecoins are legal as such.
Stablecoin Infrastructure and Asian Market Consolidation
Lloyds Corporate Markets in Jersey settled $750,000 of Visa obligations in USDC during a seven-day live pilot, with funds arriving in under an hour including over a weekend, against more than a day for traditional out-of-hours settlement. USDC was purchased through the UK-regulated Archax exchange, Lloyds ran its own Canton Network node, and Visa supported settlement on a separate public blockchain. The pilot included Visa, Brale, Barclays, NatWest and the BIS Innovation Hub's Agorà project. Visa's stablecoin network has passed 160 programs as of September with some settlement running seven days a week, while JPMorgan, Citigroup, Bank of America and Wells Fargo are developing a shared settlement network through The Clearing House targeting the first half of 2027.
In Japan, SBI Holdings completed its acquisition of Bitbank on October 1 after buying out stakes from MIXI and Ceres, becoming sole owner. The deal is valued at roughly ¥46.7 billion including share transfers and a third-party allocation, with SBI VC Trade GK acquiring 53,704 Bitbank shares and Bitbank issuing 48,952 new shares to an SBI division. Founder and CEO Noriyuki Hirosue stays on as exchange head while taking an outside director position at SBI VC Trade. The move deepens consolidation around the SBI group, which absorbed Bitpoint Japan in April 2026 and made SBI VC Trade an RLUSD distribution platform in June.
The US Treasury's Office of Foreign Assets Control also added seven TRON network addresses to its sanctions list, according to TRM Labs, which have received about $6.1 million in incoming transfers since March 2022. Analysts assess all seven as deposit addresses operated by a centralized exchange rather than self-custody wallets, pointing to links to service provider accounts. About $2.1 million went to an address tied to Erika Gabriel Cardenas Arsela, the largest single share. The designations were made under Executive Order 13224 alongside restrictions on eight individuals and two Mexican companies, creating secondary sanctions risk for foreign financial institutions. Treasury has previously reported $40.73 million in losses from more than 1,500 suspected ATM attacks as of August 2025.
Altcoins: TRUMP Gala and a Dogecoin App Layer
TRUMP memecoin organizers announced a third gala dinner for the token's 185 largest holders at Trump National Club in Washington on November 22, 2026. Seats will be allocated through a time-weighted leaderboard that opened September 30 with a snapshot on November 12, and the top 29 holders also get a VIP reception and commemorative gifts including gold watches. TRUMP rose roughly 9–10% to $2.23–2.25 on the announcement, nearly 97% below its $73–75 all-time high. Estimates put aggregate investor losses on the memecoin at $3.81 billion with insiders holding roughly 80% of supply, and Public Citizen estimated Trump family investor losses at $4.7 billion in August. The club said private meetings with the president are not included, and similar events have drawn protests and criticism from Democratic lawmakers.
DogeOS, built by the MyDoge team, opened a public Ethereum-compatible testnet where gas is paid in test DOGE, with lending, trading, prediction market and crypto-backed stablecoin apps in development. The first version relies on a permissioned sequencer, a trusted execution environment and a security council, and verification by Dogecoin nodes themselves depends on OP_CHECKZKP, a proposal published in July 2025 that remains a draft with no verification implemented. No mainnet date has been announced, and the project's creator ties the buildout to weak DOGE ETF demand after the Bitwise fund closed.
The Takeaway
The market opened the quarter without conviction: soft inflation data lifted bitcoin briefly, but 24-year-high bond yields capped the move and ETFs did not step in. Underneath that calm price action, the structural picture sharpened considerably — a record month for exploits, a large Ethereum staking withdrawal, an SEC framework for adviser self-custody, and record quarterly ETF inflows that have Citi lifting targets and a public XRP treasury preparing for Nasdaq.
