On October 1, 2026 the SEC proposed crypto custody rules for advisers and funds: state trust companies could serve as custodians, and self-custody is allowed only when no custodian supports the token. We explain the logic and the limits.
On September 30, 2026, ESMA proposed changes to MiCA: a new licensed service for firms providing access to DeFi, rules for staking and lending, and a ban on services involving non-compliant stablecoins. Here is the logic and what it means for users.
The CFTC is sweeping incentive programs on prediction markets, and on September 28 Kalshi filed to end its volume rewards program. Here is why bonuses are a problem for both the customer and the market.
Since 30 September 2026 the UK FCA has been accepting applications for full authorisation of crypto firms. We explain the timeline to October 2027, the nine regulated activities, what customers gain — custody rules, the ombudsman, risk disclosure — and what the regime does not provide: a compensation scheme or protection from price falls.
Hester Peirce leaves the SEC on October 2, 2026, leaving two of five commissioners. Under agency rules that is still a quorum. Which crypto rules are pending, and why decisions by a slim commission are less durable.
From October 1, 2026, Brazilian crypto providers must report transfers of $10,000 or more involving self-custody wallets, and since late 2024 the EU has required address ownership checks above €1,000. We explain why and what changes for users.
On September 24 New York sued Polymarket US as an unlicensed gambling business, and Polymarket countersued the same day. We explain what the conflict between the states and the federal regulator CFTC rests on and what it means for users.
After the $387.5 million Bitget hack, stablecoin issuers blacklisted one address with about $318,000, while $157 million in XRP cannot be frozen at all. Here is who can block what on-chain, and why a freeze is not the same as getting money back.
On September 24, $351.6 million left Bitget's hot and warm wallets, yet the company says no keys were stolen: the attacker spoofed transfer data and the system signed it. We explain how exchange wallets are organized, where the weak point is and what it means for customers.
The $116 million Coldcard hack showed that an offline device does not help if the seed phrase was created with too little randomness. A firmware build error cut key strength from 128 to 40 bits. What entropy is, why a firmware update cannot fix it and what owners should do.
On September 15, 2026, the US Senate fell short of the 60 votes needed for the CLARITY Act (49–50). Crypto rules are now being written by the SEC and CFTC. Here is how a law differs from an agency rule, an exemption, and staff guidance — and why temporary measures are easier to reverse.
A 2-of-3 scheme protects funds only when its keys are genuinely independent. If three seed phrases sit in one cloud account, signers use one computer, or every device stays in one room, a single theft, fire, or malware incident can compromise or disable the entire threshold at once.
