September begins with a materially different risk picture from August 31. The largest security incident from yesterday, the Tectonic exploit on Cronos, has moved from an active chain halt into a recovery and governance phase. At the same time, several scheduled deadlines have crossed into a new operational state: Luno’s affected regional accounts are now closed, Bitfinex’s standard withdrawal window for a group of delisted assets has expired, Deribit is discontinuing its public daily Proof of Reserves page, Vietnam’s new crypto-asset penalty regime takes effect, TON’s legacy bridge reaches its permanent shutdown date and BounceBit is migrating BB away from its retired mainnet.
The most important change is Cronos. The network resumed block production late on August 31 after validators halted the chain during the Tectonic exploit. Reporting based on the Cronos update says the restart used a new node version and a fresh mainnet snapshot, with the network restored using a pre-attack state. That makes the incident more than a lending-protocol exploit: it is also a chain-governance and state-recovery event.
The final Tectonic economic impact remains unresolved. Independent on-chain analysis continues to place attacker-linked affected assets around $74–75 million, with approximately $6 million reportedly bridged to Ethereum before the halt. Tectonic has not published a final loss table separating attacker proceeds, invalidated balances, liquidations, recoveries and remaining bad debt. CEXVia therefore keeps the event Critical, but the status changes to Network restarted / final loss and post-mortem pending.
Read the updated detail: Cronos Restarts After Tectonic Exploit
A second major change is Luno. Current official guidance now says affected accounts in the regional exit were closed on August 31 and impacted customers can no longer sign in. Customers with remaining funds must use a support-led bank repayment process. A monthly inactivity fee begins in September, followed by escalating dormancy fees. The risk has therefore moved from “deadline approaching” to post-closure asset retrieval.
Read the updated detail: Luno Accounts Are Now Closed
Bitfinex has also crossed a threshold. The ordinary withdrawal deadline for the affected delisted tokens expired on August 31 at 10:00 UTC. Customers who missed that window are now subject to the Delisted Token Recovery Policy. Recovery is discretionary, technical feasibility is assessed by Bitfinex, fees may apply, success is not guaranteed, there is no fixed completion time and the request window is limited.
Read the updated detail: Bitfinex Delisted Tokens Enter Recovery-Only Phase
A new transparency event begins today at Deribit. From September 1, Deribit is ending the public daily Proof of Reserves page it introduced in 2022. Deribit says the change reflects wallet-infrastructure changes during its integration with Coinbase and says approximately 90% of client assets have been migrated to Coinbase custody. It also says 1:1 reserve, client-asset segregation and external audit requirements remain. The risk is therefore a reduction in public verification frequency, not a confirmed reserve deficit.
Read the detail: Deribit Ends Daily Public Proof of Reserves
On the regulatory side, Vietnam’s Decree No. 284/2026/ND-CP takes effect on September 1. The decree establishes administrative sanctions for unlicensed crypto-asset services, marketing, issuer violations, customer-asset protection failures, KYC/AML breaches and domestic investor trading outside the licensed pilot framework. This gives global exchanges targeting Vietnam a clearer licensing and marketing risk.
Read the detail: Vietnam Crypto Fines Take Effect Under Decree 284
Two infrastructure migrations also deserve separate tracking.
The TON legacy bridge at bridge-v3.ton.org reaches its scheduled permanent shutdown date. The important distinction is that a wrapped asset can continue to exist on-chain after the bridge closes, but the official redemption route may disappear. That can create liquidity fragmentation and asset-access risk for users who missed the migration window.
Read the detail: TON Legacy Bridge Shuts Down
BounceBit is more severe. Following the August hack, the project decided to permanently sunset BounceBit Chain. Binance says support for BB on the old mainnet has ended and BB is being migrated 1:1 to BNB Smart Chain, while spot, margin, futures and Earn remain available. This is not routine maintenance: a security incident has led to permanent retirement of the original L1.
Read the detail: BounceBit Chain Shutdown and BB Migration
1. Today’s Highest-Priority Alerts
| Risk | Entity | Event | Time | Latest status | Evidence | Continue monitoring? | New vs. Aug. 31 |
|---|---|---|---|---|---|---|---|
| Critical | Cronos / Tectonic | Lending exploit and emergency chain halt | Aug. 30–Sep. 1 | Cronos restarted; final loss, bad debt and full post-mortem remain pending | Official + On-chain + Media | Yes | Network restart |
| High | Luno | Regional exit / residual customer balances | Aug. 31 onward | Affected accounts closed; support-only fund claims remain | Official | Yes | Closure completed |
| High | Bitfinex | Delisted-token withdrawal deadline | Aug. 31 10:00 UTC | Standard withdrawal expired; discretionary recovery applies | Official | Yes | Recovery-only phase |
| Medium | Deribit | Daily public Proof of Reserves discontinued | Sep. 1 | Daily public Merkle page ends; reserve/audit requirements remain | Official | Yes | Effective today |
| High | Vietnam crypto market | Decree 284 administrative sanctions | Sep. 1 | New sanction regime effective | Government | Yes | Effective today |
| High | TON Bridge | Legacy bridge shutdown | Sep. 1 | Permanent legacy route shutdown date reached | Official / Project | Yes | Shutdown date reached |
| Critical | BounceBit | Mainnet retired after hack; BB migration | Sep. 1 | Original chain sunset; BEP20 migration underway | Official | Yes | Migration day |
| High | Rain / Avici / Tria | Legacy Solana card-contract exploit | Ongoing | Reimbursements completed; provider-wide final post-mortem pending | Company + On-chain | Yes | No material new loss figure |
2. Exchange Exit, Shutdown and Withdrawal Risk
Luno — High
The event is now post-closure. Normal login and withdrawal access have ended for the affected cohort. Remaining customers depend on support and bank verification. The escalating fee schedule makes unresolved balances progressively more expensive.
Bitfinex — High
The ordinary withdrawal route is closed. Users now move through feasibility review, fee-bearing recovery and an uncertain processing timeline.
BounceBit — Critical
The original chain is not waiting for a repair-and-restart cycle. It is being permanently retired. Token continuity on BNB Smart Chain does not automatically migrate old-chain applications, contracts, NFTs or positions.
BitMEX — High
BitMEX remains in reduce-only wind-down ahead of the September 23 exchange closure. Users with open positions remain exposed to forced settlement/closure risk.
AscendEX — Critical
Withdrawals remain suspended and the claims/restructuring process remains the primary recovery route. No verified new milestone today changes the rating.
3. Regulation and Licensing
Vietnam — High
Decree 284 turns the pilot market into an enforceable administrative regime. Unlicensed service provision and marketing, customer-asset failures, issuer violations, KYC/AML failures and certain investor activity can now attract specified penalties.
Deribit / VARA — Medium transparency risk
Deribit says reserve and segregation requirements remain. What changes is the assurance model: users lose a daily public cryptographic verification layer and rely more heavily on custody structure, external audit and regulatory supervision.
WOO X / Seychelles — High, unchanged
No new verified development today changes the Seychelles FSA warning.
4. Hacks, Vulnerabilities and Asset Loss
Tectonic — Critical
The restart reduces network-availability risk but moves the event into loss reconciliation. The $74–75 million figure remains a developing estimate, not the final official loss.
Rain / Avici / Tria — High
No new verified loss expansion today. The correct status remains Reimbursement completed / forensic investigation ongoing.
BounceBit — Critical
The security incident has permanently changed project architecture. Even a successful 1:1 token migration does not reduce the significance of losing the original chain.
5. User Complaints and Operational Anomalies
No new community complaint cluster in this monitoring run is sufficiently corroborated to justify a new platform-wide solvency or withdrawal-freeze alert.
Isolated KYC delays, withdrawal tickets and account reviews remain Community / Unverified unless supported by repeated independent reports, official service degradation, regulator notices or clear on-chain liquidity evidence.
6. On-Chain and Market Anomalies
The Tectonic attacker flow remains the most important on-chain follow-up. Only a small portion of the estimated affected value appears to have reached Ethereum before the halt. Final economic impact now depends heavily on restart-state treatment and recovery.
BounceBit’s on-chain risk has shifted from attacker flow to migration and old-chain state.
Ordinary token-price moves are excluded.
7. Watchlist
| Date / Window | Event | What CEXVia is watching |
|---|---|---|
| Immediate | Cronos / Tectonic | Final post-mortem, restart mechanics, bad debt, recovery |
| Sep. 1 onward | Luno | Support backlog, residual claims, fee deductions |
| Sep. 1 onward | Bitfinex | Recovery success, fees, processing time |
| Sep. 1 | Deribit | Replacement transparency after daily PoR removal |
| Sep. 1 | Vietnam | Licensing and enforcement guidance |
| Sep. 1 | TON Bridge | Stranded legacy positions and alternative redemption |
| Sep. 1 | BounceBit | BEP20 migration and old-mainnet user guidance |
| Sep. 2 | BitMEX | Selected perpetual settlements |
| Sep. 3 | Mina | Mesa hard-fork transaction interruption |
| Sep. 5 | AscendEX | Claims Portal target |
| Sep. 5–6 | Kraken | Scheduled 21-asset delisting |
| Sep. 9 | BitMart | Restructuring roadmap target |
| Sep. 15 | Trust Wallet | Built-in support removed for 25 networks |
| Sep. 23 | BitMEX | Exchange trading closure |
8. No New Development Today, but Still High Risk
BitMart — Critical
No new verified restructuring milestone. September 9 remains the next key roadmap date.
AscendEX — Critical
Withdrawals remain suspended. Recovery depends on the claims/restructuring process.
Rain / Avici / Tria — High
Reimbursements materially improve customer-loss status, but Rain’s final technical post-mortem and provider-wide reconciliation remain outstanding.
WOO X — High
No new fact changes the Seychelles FSA warning.
Core Lightning — High
Urgent security-update monitoring remains open.
FAQ
Is Cronos back online?
Yes. Block production resumed after the emergency halt. Final Tectonic loss and bad debt remain unresolved.
Can affected Luno users still sign in?
No. Current guidance says impacted accounts were closed.
What happens to Bitfinex delisted tokens now?
Users must request discretionary recovery. Success is not guaranteed and fees apply.
Did Deribit stop holding 1:1 reserves?
Deribit says no. It is ending daily public PoR, not its reserve/segregation requirements.
What changed in Vietnam?
Decree 284 took effect, creating administrative penalties across unlicensed services, marketing, KYC/AML, issuer and customer-asset obligations.
Is BounceBit Chain coming back?
Current project/exchange guidance says the original chain is being permanently sunset and BB is migrating to BNB Smart Chain.