September 2026 was a month of sharp price moves, major regulatory decisions, and the year's biggest hack losses for the crypto market. Bitcoin plunged, then recovered, while several altcoins surged. Combined losses from major attacks topped $766M. The end of the month brought new developments in stablecoins, tokenization of traditional assets, and US crypto regulation.
What Happened on the Regulatory Front
On September 15, the US Senate again failed to advance the CLARITY Act, the bill meant to split oversight of crypto assets between the SEC and the CFTC. Forty-nine senators voted in favor and 50 against.
That same evening, Senator Cynthia Lummis declared the bill dead.
The next day, the Fed unanimously raised its rate by 0.25%, to 3.75–4%. It was the first hike since July 2023. The median forecast for the end of the year is 4.1%, which means another hike is possible this year.
Against this backdrop, bitcoin fell as low as $75,065 intraday before recovering above $76,000. US spot BTC ETFs saw $450M in outflows on September 15 and about $296M more on September 16. Liquidations topped $500M in 24 hours, mostly on long positions.
On September 17, the SEC issued a five-year exemption, known as the Innovation Exemption. It lets pre-approved venues trade tokenized shares on-chain, as long as the underlying stocks already trade on major US exchanges. SEC Chairman Paul Atkins called the move a temporary bridge to permanent rules.
On October 2, Hester Peirce will leave the SEC after almost nine years at the commission. She has led the SEC's Crypto Task Force since 2025, which developed the agency's regulatory approach to crypto assets. After her departure, the agency will be left with only Chairman Paul Atkins and Commissioner Mark Uyeda.
Bitcoin: From $75,000 to $87,000 in a Week
On September 21, spot bitcoin ETFs pulled in nearly $1B. That was the largest daily inflow in almost a year; the funds took in about $1.2B on October 6, 2025. The price climbed above $87,000, its highest level since January. Reports don't point to a single catalyst. Several factors came together: renewed risk appetite, ETF inflows, and a short squeeze after bitcoin broke through technical levels.
On September 22, the funds pulled in another $715M or so. By September 28, daily inflows had shrunk to $24M, and the price stayed range-bound. By early October, the yield on 10-year US Treasuries had topped 5.2%.
On the last day of the month, a nine-day streak of inflows into spot bitcoin ETFs ended with $148.69M in outflows. Meanwhile, analysts at Citi raised their 12-month bitcoin forecast from $82,000 to $113,000. They expect the market to take in roughly another $5B in capital over that period.
Altcoins
ETH rose about 71% over the quarter, its best quarter since early 2021 and a record for any third quarter. The previous third-quarter record, about 66%, came in 2025. By September 30, ETH was trading around $2,7.
On September 23, Hyperliquid hit an all-time high of about $98. The next day, Binance, the largest crypto exchange by trading volume, launched spot trading for HYPE for the first time. It listed the token against USDT, USDC, and the Turkish lira, with no listing fee and a Seed Tag, a label for higher-risk assets. The token already traded on Hyperliquid itself and on other centralized exchanges, while global Binance had offered only perpetual contracts. HYPE slipped on listing day.
Zcash rose about 70% in September, from $848 at the August close to $1,438 at the September close. During the month, it hit a local high, reaching $1,697 on September 27.
According to SoSoValue, as of September 24, ZCSH held $1B in net assets, with cumulative net inflows of $306.12M. About $100M of that came from its parent company, DCG, exchanging ZEC. The rest came from the trust's legacy holdings and the price rise. On September 30, Grayscale carried out a 3-for-1 split of ZCSH shares.
NEAR climbed almost threefold, from $1.93 at the end of August to about $5.39 on September 30. On September 29, Bitwise launched NRR on NYSE Arca, the first US spot NEAR fund. It drew $35.5M on its first day and finished with $36M in assets. The fund stakes NEAR itself, and staking rewards increase the net asset value per share. The management fee is 0.75%.
Hacks: Bitget and Liquid Network
For September, PeckShield counted 55 major incidents and $766.5M in losses, while CertiK counted 97 incidents and about $768M. By CertiK's estimate, August losses were about $215M.
Bitget lost the most. On September 24, an attacker drained about $387.5M from the exchange's hot and warm wallets. Private keys and cold wallets were unaffected. According to analyst reports, the attacker exploited a vulnerability in a third-party security product on August 31 and obtained internal credentials. Then, on September 24, the attacker sent forged withdrawal commands. Bitget CEO Gracy Chen suspects North Korean hackers, pointing to IP addresses.
On September 6, attackers exploited a vulnerability in Elements, the software behind Blockstream's Liquid Network, and created about 4,000 unbacked LBTC. They then moved the funds out through the peg-out mechanism. Losses were estimated at about $320M.
The hackers later returned about 3,400 BTC but kept roughly 600 BTC. They called themselves white-hat hackers and described the amount as a reward for finding the vulnerability. The network was paused.
Among smaller cases, CertiK listed user losses at Safe Wallet (7.8M),D'cent(6M), and Duelbits ($5.9M). Since the start of the year, the company has recorded 656 incidents and $2.68B in losses.
End of the Month: Open USD, Goldman Sachs, and MetaMask
On September 28, Goldman Sachs gave qualified US participants access to its Financial Square Treasury Instruments Fund (FTIXX), a government bond fund with about $100B in assets, through the Lynq settlement network.
The fund itself was not tokenized. Trades go through the registered broker-dealer tZERO Securities, and Lynq runs on Avalanche blockchain infrastructure. It is the first third-party investment product available through Lynq, which brings together participants from traditional and digital financial markets.
On September 30, Open Standard launched the Open USD stablecoin on Ethereum, Solana, Base, and Tempo. Visa, Mastercard, Stripe, Coinbase, and Shopify back it, with more than $1B in liquidity. The new coin enters a stablecoin market worth more than $300B.
Also on September 30, MetaMask reported an ongoing security incident affecting part of its infrastructure. The company said it had found no threat to user wallets but, as a precaution, began pulling the affected validators out of its non-custodial staking operations.
Our Take
September showed that the crypto market still moves faster than the rules. Fed decisions have become a trigger of their own: market participants try to guess the regulator's next move in advance, and the market reacts to expectations.
The CLARITY Act showed another side of the problem. Neither the government nor major institutions have a coherent infrastructure ready, even for basic crypto use cases. Meanwhile, on-chain trading of tokenized stocks is already taking shape. Lawmakers are falling behind, and the market finds its own routes through one-off solutions, exemptions, and workarounds. Instead of a single regulatory system, we get a patchwork of local rules, and each participant tailors them to its own needs.
The Bitget hack was a reminder that a license and a solid reputation don't guarantee that funds are safe. The weak point may not be the cryptography but how internal processes are set up and who has the power to sign a transaction. It has been several years since FTX, yet some old mistakes haven't gone away.
Against this backdrop, AI is moving closer to crypto: autonomous agents, programmable money, and payments with no human involved. That will demand even more complex infrastructure and rules. And the more decisions machines make, the more pressing the question of who answers for their mistakes.
Crypto began with the idea of decentralization, but much of it is now moving in the opposite direction, toward big platforms, intermediaries, and institutional players. Perhaps this is a temporary stage. For now, though, the market is clearly not ready for everything it is trying to take on.
