The Eurosystem launched Pontes on Monday, granting banks a live route to settle tokenized assets using central-bank money. The European Central Bank (ECB) simultaneously began preparing to invest a small portion of its own funds in tokenized securities, with those purchases set to settle through Pontes. This dual role places the ECB at the center of Europe’s emerging tokenized-market infrastructure, simultaneously operating the settlement rail and planning to invest through it. Pontes links distributed-ledger market platforms with the Eurosystem’s existing TARGET settlement services, enabling tokenized securities transactions to finalize using central-bank money. An initial consortium including Deutsche Bank, Santander, Société Générale and the European Investment Bank has completed onboarding, alongside DLT operators such as Clearstream, Axiology, Cashlink and SWIAT. Additional institutions are expected to join over the coming months. André Dragosch, Bitwise Europe Head of Research, described the system as effectively the “digital euro made available for banks,” allowing financial institutions to settle tokenized transactions with each other while retaining central-bank money as the settlement asset. This characterization underscores Pontes’s potential role in wholesale markets, where access to risk-free settlement money has been cited as a key barrier to broader adoption of distributed-ledger technology. The Eurosystem’s 2024 DLT trials found that both public- and private-sector participants viewed this access as critical to expanding tokenized finance. The platform launches with a limited suite of services and will gradually expand functionality and operating hours, with full implementation targeted for 2028. The ECB has not yet recorded a completed live settlement since Monday’s launch, leaving transaction volume as the next indicator of whether the infrastructure gains traction beyond early adopters. In parallel, the ECB is preparing to make its first purchases on the new settlement rail. The planned investment program marks a shift beyond infrastructure provision, giving the central bank direct experience across trade execution, settlement, technology systems and portfolio management. Initial purchases will focus on euro-denominated tokenized securities issued by euro-area central governments, regional governments, agencies and European supranational institutions. The ECB noted that using Pontes will allow it to test the full transaction lifecycle without embedding the purchases into monetary-policy tools such as interest-rate adjustments or quantitative easing. The ECB’s own-funds holdings totaled €23.1 billion at the end of 2025, with government debt comprising 73% of the portfolio. The size of the tokenized allocation and the start date for purchases remain undisclosed, with the Executive Board to determine both after preparatory work concludes. These funds are managed separately from monetary-policy portfolios and generate income that supports the ECB’s operating expenses. Pontes also precedes Europe’s consumer-facing digital euro initiative. The ECB plans a 12-month retail pilot beginning in the second half of 2027, involving 36 payment-service providers, merchants and central-bank staff. A potential first issuance is targeted for 2029, pending approval of relevant legislation. The two initiatives reflect separate tracks for embedding central-bank money into digital infrastructure: one for wholesale markets via Pontes, and another for retail use through the digital euro pilot. Related developments include ongoing discussions about the role of public blockchains in the digital euro. The Financial Times reported in 2025 that European officials were evaluating networks such as Ethereum and Solana as potential technological options amid concerns over the growth of dollar-backed stablecoins. The ECB stated it was examining both centralized and decentralized technologies without reaching a final conclusion. For wholesale markets, Pontes offers a near-term solution while Europe develops Appia, a broader initiative aiming to establish an integrated European DLT financial ecosystem by 2028. The current phase now depends on transaction volume. Institutions already connected must decide which tokenized securities and workflows to route through Pontes, while additional banks and market operators consider joining in the coming months. The ECB’s eventual allocation will signal the pace at which Europe’s new settlement rail transitions from available infrastructure to an actively used market.

An assessment released on September 18 by oracle provider Pragma labeled six of 22 mainnet market and rate feeds as critical risk, warning lenders that a quoted token price alone does not guarantee collateral can be sold to repay a loan. The evaluation followed a September 17 borrowing incident at Nostra, a lending protocol operating on Starknet. According to Nostra’s account, a manipulated NSTR oracle price enabled a single address to borrow roughly $3.5 million of other assets while using NSTR as collateral. Pragma placed BROTHER, DAI, DOG, EKUBO, LORDS and NSTR in its critical category, while nine additional feeds received a high‑risk rating. The report does not confirm that every listed feed is actually used as collateral.

An oracle delivers a valuation, but liquidation requires converting collateral into cash. In markets with limited depth, the sale price can fall far below the quoted amount. When a loan is backed by an apparent value that cannot be realized upon repayment, the risk of loss increases. Pragma measured sell‑quote deterioration at approximately 15 % for NSTR, 17 % for EKUBO, 22 % for LORDS and 20 % for BROTHER when selling tokens valued at $10,000, compared with quotes for $10. The September 18 snapshot showed similar decay across the four tokens.

The DAI finding focuses on source concentration and the structure of Starknet token routes. Current and legacy deployments employed different exit curves, so the critical rating should not be read as a blanket assessment of DAI’s global illiquidity. Multiple source labels may reflect overlapping dependencies rather than independent vulnerabilities. Pragma cautioned that publishers and aggregators can share underlying market risks, meaning several labels might represent shared liquidity constraints.

In its September 17 incident report, Pragma noted that the deviating input stemmed from a manipulated on‑chain pool. Reconstruction of the data revealed no decimal errors or median‑calculation flaws. For depositors, the immediate effect was restricted access to affected services. Nostra responded by pausing lending, borrowing, withdrawals and liquidations while it examined the breach and traced the funds. The company indicated that final loss figures and potential recoveries remained uncertain.

Separately, Pragma reported that the attacker’s address had been frozen and that recovery efforts were ongoing. The episode leaves lenders confronting questions beyond the mere existence of a feed: which assets qualify as collateral, how much exposure is permissible, and whether exit liquidity can support liquidation. Simply publishing a price does not resolve these issues.

Bitmine announced it acquired 27,562 ether last week, a purchase valued at approximately $75.2 million based on Monday’s market price of $2,727. The acquisition brings the company’s total ether holdings to 5,983,940 ETH, representing roughly 4.9% of the token’s 122.1 million circulating supply. This marks the latest in a series of weekly purchases that began in June 2025, when Bitmine shifted its strategy toward operating as a crypto treasury firm.

Chairman Tom Lee, who also co-founded Fundstrat, stated that institutional investors continue to be underweighted in crypto assets. He suggested that the recent outperformance of AI-related equities may have contributed to this positioning, and anticipated a shift in exposure during the final quarter of 2026. Lee noted that the current gap between Ethereum’s price movement and traditional market benchmarks could prompt fund managers to reassess their allocations.

The company has staked approximately 5 million ETH, equivalent to about 85% of its holdings, and projects annual staking revenue near $357 million at current yield rates. Bitmine’s shares rose 5.8% in pre-market trading, extending a rally that followed a broader increase in ether’s price.

Lee also highlighted tokenization and expanding blockchain applications in artificial intelligence as longer-term factors that may drive institutional adoption. He emphasized that while crypto has underperformed in some institutional portfolios this year, its recent performance trajectory suggests growing interest ahead of potential late-year adjustments.

Hyperliquid, a decentralized exchange focused on perpetual futures, began offering perpetual contracts tied to the Bitcoin Volmex Implied Volatility Index on Monday. The contracts, known as BVIV perps, enable traders to take long or short positions on the expected 30‑day price volatility of bitcoin rather than on price direction itself. The index, often referred to as a "bitcoin VIX," measures real‑time implied volatility over a month and mirrors the methodology of the Cboe VIX used on Wall Street. Trading on the BVIV perps will commence on Tuesday after a brief scheduling adjustment, according to Volmex. The products are collateralized and denominated in USDC, with up to five‑times leverage available at launch. The launch was led by Markets by Kinetiq, the on‑chain perpetual futures platform built on Hyperliquid, in partnership with Volmex and Perps.inc. It represents the first joint deployment of a perpetual market for Volmex’s volatility index and the first on‑chain perpetual futures contract for the index. Cole Kennelly, founder and chief executive of Volmex Labs, described the listing as a "massive unlock" for crypto traders and investors, noting that it provides an easier way to hedge, speculate, and obtain pure Bitcoin volatility exposure. Justin Greenberg, co‑founder and chief technology officer of Kinetiq Markets, added that the collaboration demonstrates a scalable model for expanding the range of tradable assets on the Hyperliquid ecosystem. The BVIV perpetual joins a suite of other perpetual contracts on Hyperliquid that reference crypto, equities, legacy indices, and commodities. Hyperliquid ranks among the largest decentralized exchanges for perpetual futures, processing billions of dollars in daily trading volume. The exchange’s fully diluted valuation exceeds $90 billion, underscoring its prominence in the decentralized finance space.

A quantitative analyst identified a pattern of identical $5,500 trades that accounted for a large share of Kalshi's ether perpetual contract volume over four days.

The trades contributed to nearly 58 percent of the platform's reported ether perpetual trading volume during that period, according to the analyst's post. This observation prompted scrutiny of how the exchange calculates its headline volume figures.

Kalshi's crypto lead, who goes by the handle IcoBeast.eth, responded that the platform's reporting method follows an industry convention used by other regulated prediction markets. The exchange measures volume based on the maximum potential payout of each contract rather than the cash actually exchanged. For example, purchasing 100,000 contracts priced at 30 cents would involve a $30,000 cash outlay, but the system records $100,000 in volume because that reflects the total payout if the contract resolves successfully. This approach, the lead explained, reflects user demand rather than artificial activity.

The analyst also highlighted a CFTC filing showing a rebate schedule that could result in zero net fees for certain self-clearing members. Under this structure, a 0.3-basis-point maker rebate offsets a 0.3-basis-point taker fee, potentially reducing the cost of trading against oneself to zero. The analyst argued that such incentives might encourage volume manipulation, though Kalshi's lead countered that the exchange does not offer rebates on its crypto perpetual contracts.

Kalshi's representative emphasized that the platform operates under CFTC regulations requiring fair access for all eligible self-clearing members. Membership is not restricted to a select group but depends on meeting standard regulatory requirements. The exchange also files all incentive programs publicly, distinguishing its transparency from offshore competitors that may negotiate terms privately.

The controversy centers on the distinction between reported trading volume and actual capital deployed. While the reported figures appear disproportionately high relative to open interest, the exchange maintains that the methodology aligns with established industry practices for prediction markets.

Open interest, which tracks the total value of outstanding contracts, stood at $3.1 million during the period in question, compared to a reported $539 million in 24-hour trading volume. Such a ratio typically raises questions about market authenticity, but the exchange attributes the discrepancy to its reporting convention rather than deceptive practices.

The discussion underscores broader debates about transparency and measurement in regulated digital asset markets. As new products like U.S.-based perpetual futures emerge, platforms must navigate regulatory expectations while clarifying how they quantify market activity.

The exchange has not altered its reporting framework in response to the allegations, and no formal enforcement action has been announced. The situation remains under observation by market participants and regulators alike.

The case illustrates how technical details of market infrastructure can become focal points for scrutiny when new financial instruments enter regulated spaces.

A security firm has warned that a sophisticated iOS exploit chain known as Darksword may have been adapted to target the iOS 26.5 operating system, potentially allowing attackers to extract private keys from cryptocurrency wallets stored on affected devices.

SlowMist, a blockchain security company, said the modification enables the exploit to bypass Apple’s built‑in security controls and gain access to wallet data on iPhones running the newer software version. The claim has not been independently verified by Apple or Google.

Google’s Threat Intelligence Group previously documented Darksword activity against iOS versions 18.4 through 18.7, describing it as a six‑vulnerability chain that delivers separate malicious payloads after initial compromise. One of those vulnerabilities, CVE‑2025‑43529, affected JavaScriptCore in Safari and was patched in iOS 18.7.3 and iOS 26.2 after Google’s disclosure.

According to SlowMist’s chief information security officer, the updated chain can now operate on iOS 26.5, although the specific vulnerability or replacement exploit used remains unconfirmed. The attack typically begins when a user clicks a malicious link delivered via social networks, messaging apps, or other channels, causing the content to load in Safari. Once the chain succeeds, attackers may achieve root‑level control, allowing them to read files and credentials from other applications, including private keys and wallet recovery phrases.

Google identified several groups exploiting Darksword, each deploying different final‑stage payloads that could harvest account details, messages, browser history, location data, Wi‑Fi settings, and cryptocurrency wallet information. Victims have been reported in Saudi Arabia, Turkey, Malaysia, and Ukraine. Some activity appears linked to commercial surveillance providers and suspected state‑affiliated actors, while other incidents involve financially motivated groups seeking advanced iPhone exploitation tools.

The warning follows a separate legal dispute involving U.S. investors who allege that counterfeit wallet applications distributed through Apple’s App Store caused approximately $1.835 million in Bitcoin losses. Apple has removed some of these fraudulent listings, but the cases highlight broader concerns about the security of Apple’s software distribution ecosystem.

SlowMist recommends that users install the latest iOS updates promptly and avoid opening unsolicited links from unknown sources. The firm also emphasizes that timely patching remains the most effective defense against such exploit chains.

Earlier in the month, Binance issued a similar advisory regarding malicious versions of the FomoPeek app, which contained a kernel exploitation framework capable of accessing private keys and wallet recovery phrases across a range of iOS versions. Both incidents illustrate ongoing efforts to compromise cryptocurrency assets stored on Apple devices.

The situation underscores the importance of maintaining up‑to‑date software and exercising caution when interacting with unfamiliar online content, particularly in the context of digital asset management.

A researcher using the alias “Liquid” returned 3,400 BTC to the federation wallet after Blockstream patched vulnerable bridge nodes, but kept 598.5 BTC that remain unaccounted for. Immunefi CEO Mitchell Amador said the partial restitution does not restore the group’s standing as a white‑hat actor. “Coordinated disclosure ends the moment you set the terms yourself,” Amador told crypto.news. “The money was never yours to save, so moving it is not a rescue.”

Blockstream rejected the attackers’ demand for a 10 % bounty and declined to pay for the remaining Bitcoin. The company also dismissed the claim that the operation qualified as responsible disclosure. A technical review indicated that a cache‑key collision in the confidential transaction verification logic allowed the actors to create unbacked L‑BTC, which they later exchanged for real Bitcoin through SideSwap’s peg‑out service. Federation keys were not compromised, according to Blockstream.

Amador argued that security researchers must use private disclosure channels, preferably through a defined bug‑bounty program, rather than seizing assets and negotiating rewards afterward. “Keep a dollar of user funds, and it is theft, whatever the intent was at the outset,” he said. He added that finding a vulnerability does not grant the right to move user assets, hold them as collateral, or dictate compensation.

The CEO emphasized that serious protocols should establish rescue terms before an exploit occurs. Predetermined rules can specify which systems researchers may test, how they must disclose a vulnerability, and what actions they may take during an active incident. They can also set maximum bounty amounts, payment conditions, and legal protections for researchers who stay within the approved scope. Immunefi’s Whitehat Safe Harbor framework was created to provide such conditions in advance.

Amador compared emergency intervention to saving a house from a fire: the need for help does not authorize every possible rescue method. Advance agreements give protocol teams a basis for distinguishing approved intervention from coercion. Without prior terms, an actor who controls user funds can demand payment while the project faces losses, service disruptions, and pressure from token holders.

The attackers initially communicated through messages embedded in Bitcoin transactions, instructing Blockstream to patch the flaw before returning the funds. After Blockstream confirmed that the affected bridge nodes had been patched, the group sent 3,400 BTC back to the federation wallet. No publicly disclosed agreement had permitted the group to retain the remaining 598.5 BTC, an amount that exceeds 10 % of the roughly 4,000 BTC involved.

While rejecting the Liquid actors’ attempt to impose their own terms, Amador defended the industry’s informal practice of offering up to 10 % of funds at risk as a white‑hat bounty. He said a common reference point prevents each settlement from being negotiated from scratch, which would give an attacker more leverage during an active incident. A defined percentage provides researchers with a legal payment route while allowing a protocol to recover most of the exposed assets.

Amador noted that a 10 % bounty on a $100 million exploit would yield $10 million earned legally, whereas moving nine‑figure sums onchain invites intense forensic scrutiny. The 10 % figure has appeared in several recovery offers, though projects typically state the terms themselves. In August, supporters of BTCPay Server backed a reward equal to 10 % of recovered funds, capped at 3 BTC if all stolen assets were returned. Cetus Protocol followed a different formula after its May 2025 exploit, announcing a $5 million reward for information leading to the attacker’s identification.

The CEO warned that setting the reward too low could make theft more attractive than disclosure, while an excessive payout could jeopardize the rescued project’s ability to operate. “Price it too high, and paying out can kill the protocol you just saved, which helps nobody,” he said. Under his proposed model, the protocol retains control over any decision to exceed the stated cap.

Amador also highlighted legal risks for U.S.-based researchers who return funds or negotiate after unauthorized access. In December 2023, former security engineer Shakeeb Ahmed pleaded guilty to computer fraud after exploiting two decentralized exchanges and obtaining more than $12 million. Prosecutors said Ahmed negotiated with one platform to return most of the stolen funds except for $1.5 million, contingent on the exchange’s promise not to contact law enforcement. He later agreed to forfeit more than $12.3 million, including about $5.6 million in cryptocurrency, and received a three‑year prison sentence in April 2024.

The case illustrates that even well‑intentioned attempts to resolve an exploit can carry criminal consequences when the initial access was unauthorized.

PEPE jumped 24.75% on September 21, breaking above $0.00000458, a level previously identified as a key structural barrier. The move lifted the meme coin to an intraday high of $0.00000515 and pushed its market capitalization past $2 billion, with 24-hour trading volume nearing $900 million. The rally coincided with a broader crypto rally that saw Bitcoin climb above $85,000, its highest level in eight months, as exchange-traded funds managed by firms including BlackRock and Fidelity attracted approximately $433 million in inflows on Friday, according to JPMorgan data cited by the Wall Street Journal.

Technical indicators show mixed signals. The 4-hour Relative Strength Index reached 82.05, placing it in overbought territory above the commonly watched 70 threshold. The indicator’s moving average stood at 70.13, confirming accelerating momentum during the breakout. Meanwhile, the Awesome Oscillator turned positive at approximately 0.00000033, suggesting short-term momentum now exceeds longer-term momentum. Price has also moved above its 20-day, 50-day, 100-day and 200-day simple moving averages, marking a shift from the bearish structure that dominated the first half of 2026. The 20-day SMA sits near $0.00000364, the 50-day near $0.00000337, the 100-day near $0.00000330 and the 200-day around $0.00000305.

Liquidation data from CoinGlass reveal concentrated clusters of leveraged positions between $0.00000410 and $0.00000450, with additional dense bands near $0.00000355–$0.00000370 and another around $0.00000320. These zones represent areas where forced closures could amplify volatility if price reverses. Smaller clusters also exist above the current level near $0.00000510–$0.00000524, meaning a renewed push toward the intraday high could trigger additional short liquidations and extend the rally.

Analyst Crypto Patel noted that PEPE has risen about 97% from a higher-time-frame accumulation zone between $0.00000200 and $0.00000270. He described the current move as the start of an accumulation phase, with $0.000004583 as the critical level that must be reclaimed and converted from resistance to support. A daily close above that threshold, followed by a retest, would strengthen the bullish case. Patel projected potential targets of $0.000010, $0.000016 and $0.000027 if PEPE also breaks its higher-time-frame downtrend, though he emphasized these remain projections rather than confirmed outcomes.

The immediate outlook hinges on whether buyers can defend $0.00000458 after the 25% daily advance. Holding that level would keep $0.00000515 and $0.00000550 in view, while a drop below it could expose the token toward Supertrend support near $0.00000431 or the broader liquidation zone around $0.00000360. A sustained move above $0.00000515 would be required to confirm progress toward the next technical test range of $0.00000515–$0.00000550.

Ethereum developers are evaluating a change to block timing that could reduce latency without increasing per-second capacity. The proposal, known as EIP-8198 or Quick Slots, would shorten the current 12-second block interval to either eight or ten seconds. The change remains in a proposed status and has not been adopted. The decision hinges on validator performance, as shorter intervals would give validators less time to receive, verify and attest to each block. Proponents argue that faster block times could allow onchain prices to update more quickly and accelerate transaction confirmations and finality. The draft specification uses eight seconds as a placeholder, though the exact target may be adjusted based on performance testing. Ethlabs, a research group, has suggested beginning with a ten-second interval and only reducing it further if safety evidence accumulates. An alternative rewrite also favors ten seconds but has not been merged into the main draft. The outcome could involve starting at ten seconds, retaining the eight-second parameter, or maintaining the existing twelve-second schedule if testing indicates risk. Under any shorter target, the number of blocks per second would remain roughly stable only if gas limits and blob capacity are adjusted proportionally. Smaller blocks would arrive more frequently, potentially enabling faster market updates and earlier transaction inclusion. Finality estimates suggest a reduction from about thirteen minutes to eight and a half minutes under the eight-second model, though these figures are projections rather than observed results. The proposal also includes assumptions about reduced arbitrage losses, though the magnitude of such gains remains subject to modeling limitations and market variability. Technical analysis indicates that faster block pacing increases computational and bandwidth demands per second, potentially affecting validators with slower connections or less powerful hardware. Some attestation delays have been observed in current network behavior, suggesting that timing margins may already be tight for certain operators. The proposal acknowledges uncertainty regarding blob propagation, block building and validator infrastructure. Developers have linked the change to broader efforts to improve payload transmission and execution-layer performance. A recent assessment by the Ethereum Foundation placed Quick Slots in a mid-tier priority category, reflecting cautious support based on research findings rather than implementation readiness. The decision will require empirical validation through testing on development networks and simulation of validator behavior before any network-level change is considered.

A political action committee backed by major crypto firms Coinbase and Ripple Labs has announced it will allocate $30 million to oppose Senator Sherrod Brown's campaign for re-election to the U.S. Senate. The group, named Fairshake, confirmed the figure to Cointelegraph, citing reporting by The New York Times that the spending target initially applied to Brown's 2026 Senate race in Ohio. A spokesperson for Fairshake, Geoff Vetter, indicated the organization planned to reveal further disbursements before the November 3 midterm elections. In the 2024 cycle, Fairshake had previously directed approximately $41 million toward supporting Republican candidate Bernie Moreno and opposing Brown's re-election effort. That campaign, which involved over $300 million in combined expenditures by Fairshake and allied groups, resulted in Moreno defeating Brown by a margin of about four percentage points. Brown had previously chaired the Senate Banking Committee during the period when Democrats held the chamber's majority. Fairshake is among several industry-aligned entities working to shape outcomes in the 2026 elections, when all House seats and one-third of the Senate will be contested. As of Monday, prediction market contracts on platforms such as Kalshi assigned Democrats a probability of regaining control of both chambers. Cointelegraph attempted to obtain comment from Brown's campaign but received no immediate response. Vetter declined to elaborate on Fairshake's strategic approach for the upcoming midterms, though he noted in August that the committee maintained a $122 million reserve ahead of the election cycle. The development underscores the growing intersection of cryptocurrency industry financing and electoral politics in key swing states.

X has filed a lawsuit in the High Court of England and Wales alleging that a network of Bitcoin-focused accounts manipulated engagement to obtain at least $278,000 in creator payouts from its former revenue-sharing program. The complaint names Vivek Kumar Sen, Zamyang Sherpa and several unnamed operators, accusing them of coordinating multiple accounts to boost likes, replies and reposts, thereby creating a false appearance of genuine human interaction. Six accounts — @Vivek4real_, @Bitcoin_Teddy, @saylordocs, @TrendingBitcoin, @Kalshibacktest and @PolyBackTest — were linked to Stripe accounts tied to Sen and Sherpa, having joined the program between August 2023 and February 2026. The filing also references additional accounts such as @BTC_Vibes, @MrSuperBitcoin and @Laserlump, which allegedly engaged with the defendants’ content to inflate metrics. X suspended the accounts on August 18 and retired the revenue-sharing program on September 7, replacing it with Original Content Rewards. The company estimates investigation and remediation costs of at least £75,000 ($100,000), bringing total alleged losses to approximately £282,384 before interest and legal fees. Cointelegraph attempted to obtain comment from Sen via the email address listed in the filing but received no response; Sherpa could not be reached.