Risk landscape
September 2 is being driven by security recovery, asset-access restrictions and market-structure regulation rather than a new large centralized-exchange collapse.
Injective is clarifying the scope of a binary-options application exploit; Zilliqa is approaching a scheduled recovery hard fork after a proven Ledger signing vulnerability; ICON has published a detailed replay-attack post-mortem; Kraken is inside a forced-liquidation window for 21 delisted assets; Singapore MAS is moving its stablecoin framework toward legislation; and the U.S. SEC has proposed modernizing transfer-agent rules in a way that explicitly recognizes blockchain-based securities operations.
The most important timing correction is Zilliqa. Its first exchange-migration recovery hard fork is scheduled at block 34,844,968, estimated around 12:58 UTC on September 2. At the time of this report, that activation has not yet occurred. CEXVia therefore labels it Scheduled / Pending rather than completed.
① Today’s Highest-Priority Alerts
| Risk | Entity | Event | Time | Latest Status | Evidence | Continue Monitoring | New vs Previous Day |
|---|---|---|---|---|---|---|---|
| High | Injective | Binary-options app exploit + accelerated upgrade | Aug. 31–Sep. 2 | Attack vectors patched; core chain/user funds said safe; final loss and interruption mechanics unresolved | Official + Exchange + On-chain/Media | Yes | Official scope clarification |
| Critical | Zilliqa | Ledger exploit recovery hard fork | Sep. 2, est. ~12:58 UTC | Scheduled, not yet executed at report time | Official | Yes | Recovery fork due today |
| High | ICON | Migration-contract replay exploit | Aug. 27; post-mortem Aug. 30 | Root cause fixed; network restored; most ICX reportedly frozen; net confirmed loss ~150.2 ETH + 31,204 USDC | Official | Yes | Full official accounting |
| High | Singapore / MAS | Stablecoin framework | Sep. 1 onward | Consultation open; reserve, redemption, regulatory label and yield restrictions proposed | Official regulator | Yes | New consultation |
| Medium | U.S. SEC | Transfer-agent rules modernization | Sep. 1 | Proposal explicitly recognizes blockchain use in securities/share transfers | Official regulator | Yes | New market-structure proposal |
| High | Kraken | Forced liquidation of 21 delisted assets | Sep. 1–5 | Remaining balances being liquidated; thin markets may produce minimal proceeds | Official exchange | Yes | Liquidation window active |
| Critical | Cronos / Tectonic | Tectonic exploit / state recovery | Ongoing | Cronos restarted; final loss and bad debt still pending | Official + On-chain | Yes | No final accounting |
| Critical | AscendEX | Withdrawals suspended / claims | Ongoing | Claims Portal target remains Sep. 5 | Official | Yes | No material new development |
② Exchange exit, shutdown and withdrawal risk
Kraken — High. Kraken’s 21-asset delisting cycle is now inside the September 1–5 automatic-liquidation window. Holders who missed the withdrawal deadline no longer control the execution venue or timing. Kraken warns that limited or inactive markets may produce liquidation prices far below recent reference prices and, in some cases, minimal or no proceeds.
BitMEX — High. Reduce-only wind-down continues ahead of the September 23 trading closure. Open positions remain exposed to forced closure as the shutdown advances.
Luno — High. Affected regional accounts are already closed. Residual funds continue through support-led repayment rather than normal self-service withdrawal.
AscendEX — Critical. Withdrawals remain suspended. The September 5 claims-portal target remains the next important milestone.
③ Regulation and licensing
Singapore MAS — High regulatory significance. MAS is consulting on legislation for a Single-Currency Stablecoin framework built around 100% reserve backing, par redemption, capital/disclosure safeguards, a protected “MAS-regulated stablecoin” label and proposed limits on issuer-paid yield.
U.S. SEC — Medium market-structure significance. The SEC’s September 1 transfer-agent proposal explicitly cites blockchain technology used in securities offerings and share transfers. This is not a crypto enforcement case, but it directly affects the compliance architecture of tokenized securities.
UK FCA — Watch. The application period for the UK’s new crypto regime is scheduled to open September 30.
④ Hacks, vulnerabilities and asset loss
Injective — High. Application exploit is confirmed. The ~$4.9M figure remains an independent estimate. Base-chain compromise is not established. The exact block-production interruption remains disputed between Injective’s characterization and exchange/archive-node evidence.
Zilliqa — Critical. Zilliqa reports 683,130,969.66 ZIL of proven theft, 6,772 known exposed accounts and 51 drained accounts. Today’s scheduled fork is a recovery mechanism, not evidence the original incident was minor.
ICON — High. Gross exploit flow and final loss are materially different. ICON says 119.866M ICX was released, but current confirmed net loss is approximately 150.2 ETH + 31,204 USDC because much of the gross value was frozen or recovered.
⑤ User complaints and operational anomalies
No new community complaint cluster identified in this run met CEXVia’s threshold for a platform-wide High/Critical alert. Isolated KYC delays, source-of-funds reviews, account restrictions and withdrawal tickets remain Community / Unverified unless corroborated by multiple independent reports plus official, operational or on-chain evidence.
⑥ On-chain and market anomalies
Injective’s attacker-linked ETH remains a developing on-chain item and should be monitored for movement.
ICON’s exchange-linked ICX is a more mature recovery case: the Foundation says much of the exploited ICX is frozen and preservation requests have been sent.
Zilliqa’s recovery design is unusual because legitimate exchange balances and identified attacker balances are treated differently at protocol-state level.
⑦ Watchlist
| Date / Window | Event | What CEXVia Is Watching |
|---|---|---|
| Sep. 2, est. ~12:58 UTC | Zilliqa | Whether first exchange-migration hard fork activates successfully |
| Immediate | Injective | Technical post-mortem, final loss, block timeline, exchange reopenings |
| Immediate | ICON | Exchange cooperation, ICX recovery, law-enforcement progress |
| Sep. 1–5 | Kraken | Realized forced-liquidation prices |
| Sep. 3 | Mina | Mesa hard fork and temporary transaction interruption |
| Sep. 5 | AscendEX | Claims Portal target |
| Sep. 9 | BitMart | Restructuring / resumption roadmap |
| Sep. 23 | BitMEX | Exchange trading closure |
| Sep. 30 | UK FCA | New crypto-regime application period opens |
| Oct. 16 | Singapore MAS | Stablecoin consultation closes |
| Federal Register + 60 days | U.S. SEC | Transfer-agent proposal comment deadline |
⑧ No new development today, but still high risk
Cronos / Tectonic — Critical: network is back, but final Tectonic loss, bad-debt accounting and final post-mortem remain unresolved.
BounceBit — Critical: original chain has been permanently sunset after the hack; old-chain/self-custody migration risk continues.
BitMart — Critical: no new verified restructuring milestone; September 9 remains the next major date.
AscendEX — Critical: withdrawals remain suspended.
Rain / Avici / Tria — High: reimbursements are complete according to the affected companies, but Rain’s provider-wide final technical post-mortem remains outstanding.
WOO X / Seychelles — High: no new verified fact changes the Seychelles FSA warning.
Today’s Detail pages
- Injective Binary-Options Exploit
- Zilliqa Ledger Exploit and Recovery Hard Fork
- ICON Replay Exploit Post-Mortem
- Singapore MAS Stablecoin Framework
- SEC Transfer Agent Rules and Blockchain Securities
- Kraken Forced Liquidation of 21 Delisted Assets
FAQ
What is the most important live security event on September 2?
Injective is the most important newly clarified live exploit, while Zilliqa’s scheduled recovery fork is the largest remediation event due later today.
Has the Zilliqa hard fork already happened?
Not at the time of this report. It is scheduled at block 34,844,968, estimated around 12:58 UTC on September 2.
Was Injective’s base chain hacked?
Injective says no. The application exploit is confirmed, while the exact network-interruption timeline remains disputed.
How much did ICON actually lose?
ICON’s current confirmed net loss is approximately 150.2 ETH plus 31,204 USDC, materially lower than the gross ICX released.
What is MAS proposing for regulated stablecoins?
At least 100% reserve backing, par redemption, capital/disclosure safeguards, a protected regulatory label and proposed yield restrictions.
Why do the SEC transfer-agent rules matter for crypto?
Because the proposal explicitly recognizes blockchain use in securities offerings and share transfers, directly affecting regulated tokenized-securities infrastructure.