Regulators sharpen the rules as crypto infrastructure absorbs a security shock
U.S. and European regulators moved from broad principles toward operational rules for stablecoins, staking receipts and DeFi access, while UK banks completed live tokenized-deposit payments. In infrastructure, Lightning developers published both an urgent security release and an early post-quantum design, as Bitget set a phased withdrawal-reopening plan after this week's $351.6 million breach.
Written by NPDev Labs with AI assistance and reviewed before publication. How we work.
The Fed proposes reserve, capital and approval rules for supervised stablecoin issuers
Section: Top stories. Status: REGULATION · PROPOSAL. On September 24, the Federal Reserve opened two GENIUS Act rulemakings: one would require eligible reserve backing, standardized credit and operational-risk capital, risk controls and safekeeping standards; the other would create an application process for supervised banks seeking to issue payment stablecoins. Comments close 60 days after Federal Register publication, so none of these requirements is final yet. Why it matters: The proposals turn the U.S. stablecoin framework into concrete balance-sheet and licensing obligations, which will shape who can issue at scale and how much capital growth consumes.
SEC staff clarifies staking receipts, post-launch work and token buybacks
Section: Top stories. Status: SEC STAFF GUIDANCE · CONFIRMED, NON-BINDING. FAQs issued September 25 explain that a staking receipt token may be treated as a digital tool or digital commodity when it merely evidences ownership of an underlying non-security asset and does not add rights or issuer-controlled rewards. Staff also said maintenance and upgrades on an already functional network generally are not essential managerial efforts, while pre-functionality buyback or marketing promises can still matter under Howey. The FAQs have no legal force and remain fact-specific. Why it matters: The guidance gives exchanges, liquid-staking providers and protocol teams a more usable structuring map, but not the durable certainty of a statute or Commission rule.
Bitget sets a phased withdrawal reopening after its $351.6 million breach
Section: Top stories. Status: SECURITY RECOVERY · ANNOUNCED. Bitget said on September 26 that it identified and remediated the vulnerability behind the September 24 theft and plans to restore withdrawals in stages: Bitcoin on September 28, Ether on September 29, USDT on September 30, and remaining tokens plus fiat and P2P by October 2. The exchange says customer balances were unaffected and its Protection Fund will absorb the loss; those claims and the attack attribution remain under investigation. Why it matters: A timetable is operational progress, not proof of full recovery. Users and counterparties still need to watch whether each asset actually reopens, whether frozen funds are recovered and whether independent incident findings support the exchange's assurances.
UK banks complete live cross-bank payments with tokenized sterling deposits
Section: Markets & institutional adoption. Status: TOKENIZATION · CONFIRMED LIVE PILOT. UK Finance said Barclays, HSBC UK, Lloyds Banking Group, Monzo, Nationwide, NatWest and Santander completed live retail transactions on the shared Great British Tokenised Deposit platform. The pilots included two remortgage completions and a consumer marketplace payment in which bank deposits were programmatically locked and released when conditions were met. Why it matters: This is real commercial-bank money moving between institutions, not a proof-of-concept balance. It demonstrates programmable settlement while preserving the legal and regulatory protections of bank deposits, and sets up planned digital-asset settlement pilots.
European banking regulators put DeFi lending access on the MiCA review agenda
Section: Protocols, products & regulation. Status: EU POLICY · RECOMMENDATION. In a September 24 consultation response, the European Banking Authority asked the European Commission to assess bringing intermediated crypto borrowing and lending—and crypto firms that route customers to DeFi lending protocols—inside MiCA. Options include suitability checks, leverage limits, fuller disclosures, protocol-resilience certification and restrictions involving unauthorized stablecoins. No rule changed, and any binding amendment would require later legislation. Why it matters: Regulation could attach at the wallet or interface layer even when the underlying smart contract is decentralized, raising compliance costs and changing how European users reach onchain credit markets.
Core Lightning ships a security release and urges operators to upgrade
Section: Protocols, products & regulation. Status: BITCOIN INFRASTRUCTURE · SECURITY RELEASE. Core Lightning 26.06.8 fixes responsibly disclosed vulnerabilities and is available now. A few tests are temporarily withheld to give node operators time to patch before attackers can more easily infer the bugs; operators who ran development builds cannot downgrade because their database schema is newer. Why it matters: Lightning nodes are continuously online and directly exposed to peers, so delayed patching can turn privately reported flaws into exploitable operational risk. Operators should treat this as a priority maintenance release rather than a routine feature update.
Researchers publish an early post-quantum design for Lightning
Section: Protocols, products & regulation. Status: BITCOIN R&D · PROPOSAL. The PQLN proposal adapts Lightning gossip, transport, invoices, offers and onion routing to post-quantum primitives and includes a rust-lightning test implementation. Regtest interoperability with classical nodes worked in the reported tests, but the design does not make onchain Bitcoin operations quantum-resistant, carries roughly 10× download and 9× storage overhead, and still has open pinning and relay-limit issues. Why it matters: The work moves post-quantum planning from threat analysis toward testable code, while showing that migration costs and Bitcoin base-layer dependencies remain substantial.
Bottom line
Policy is becoming more operational: the Fed is defining stablecoin balance-sheet requirements, SEC staff is clarifying how network functionality affects securities analysis, and European regulators are targeting the interface between users and DeFi. Adoption is also becoming more concrete through live tokenized bank deposits. Against that progress, Bitget and Core Lightning are reminders that custody and node-security controls remain immediate, not theoretical, constraints.
As of
September 26, 2026 at 15:00 UTC. Research emphasized developments published or materially updated during the prior 24–48 hours.