September 4 is primarily a regulatory and asset-access risk day rather than a new major protocol-loss day.
The strongest new licensing signal is Australia’s ASIC final call. Digital-asset businesses relying on the regulator’s sector-wide no-action position have until September 30, 2026 to apply for or vary an Australian Financial Services licence, or satisfy another qualifying transition arrangement. From October 1, firms that require authorisation but fall outside the relief conditions face enforcement exposure under Australian financial-services law. ASIC has also warned that civil and criminal penalties can apply, with potential maximum fines reaching up to 10% of annual turnover in applicable cases.
Read the detail: ASIC Digital Asset Licensing Deadline
A second major regulatory milestone is Revolut’s conditional U.S. national-bank approval. Revolut announced that the Office of the Comptroller of the Currency conditionally approved formation of Revolut Bank US. This is not a full bank launch. The proposed bank still requires FDIC, Federal Reserve and final OCC approvals. Revolut is targeting a 2027 launch and has also discussed a future stablecoin product.
Read the detail: Revolut Conditional OCC Approval
Thailand requires two updates today. First, the Digital Asset Travel Rule page needs a timing correction: the SEC issued the rules in September 2026, but the official effective date is February 27, 2027. The rules require customer/counterparty information collection, counterparty VASP due diligence, self-hosted-wallet ownership/control checks, originator/beneficiary information transmission and at least five years of record retention.
Read the updated detail: Thailand Digital Asset Travel Rule
Second, Thailand SEC filed a criminal complaint involving Holdstation, UNO and alleged supporters, including Tools for Humanity Corporation and an executive, over alleged unlicensed digital-asset brokerage. The SEC says access relating to Holdstation and UNO will be blocked in Thailand from October 1, 2026, and it explicitly advises users to consider actions regarding assets before the blocking date. The complaint is an allegation and legal proceeding, not a final conviction.
Read the detail: Thailand Holdstation and UNO Access Blocking
On the security side, Aquifer’s whitehat deadline has passed. The prior offer asked for at least 80% of stolen assets to be returned while allowing the attacker to retain up to 20%. In this monitoring run, CEXVia did not find reliable public confirmation that a qualifying return occurred. That is not proof no funds moved; the precise status is Whitehat deadline passed / qualifying return not publicly verified in reviewed sources. The approximately $2.47 million loss figure remains an independent on-chain reconstruction rather than an Aquifer final official loss.
Read the update: Aquifer Solana AMM Exploit
① Today’s Highest-Priority Alerts
| Risk | Entity | Event | Time | Latest Status | Evidence | Continue Monitoring | New vs Previous Day |
|---|---|---|---|---|---|---|---|
| High | Australia / ASIC | Digital-asset licensing transition | Sep. 3–30 | Final call issued; relief deadline Sep. 30; enforcement exposure from Oct. 1 for firms outside conditions | Official | Yes | New final-call notice |
| Medium | Revolut | U.S. national bank charter | Sep. 3 | OCC conditional approval; FDIC, Fed and final OCC still pending | Official + Media | Yes | New licensing milestone |
| High | Thailand / Travel Rule | Digital-asset transfer controls | Issued Sep. 2 | Effective Feb. 27, 2027; self-hosted-wallet verification and 5-year retention included | Official | Yes | Effective-date correction |
| High | Holdstation / UNO / TFH | Alleged unlicensed brokerage | Complaint Sep. 1; blocking Oct. 1 | Criminal complaint filed; Thailand access blocking scheduled; users advised to address assets beforehand | Official | Yes | Backfilled enforcement alert |
| High | Aquifer | Solana AMM exploit recovery | Deadline passed Sep. 3 | ~$2.47M independent on-chain estimate; qualifying return not publicly verified in reviewed sources | On-chain + Security research | Yes | Whitehat deadline passed |
| Critical | Zilliqa | Ledger exploit recovery | Ongoing | First exchange migration complete; retail recovery and compensation governance pending | Official | Yes | No material new update |
| Critical | AscendEX | Withdrawals suspended / claims | Sep. 5 next milestone | Claims Portal target remains Sep. 5; recovery uncertain | Official | Yes | Deadline now one day away |
| High | Kraken | Forced liquidation of 21 assets | Sep. 1–5 | Forced-liquidation window remains active | Official | Yes | No verified aggregate execution data |
② Exchange Exit, Shutdown and Withdrawal Risk
AscendEX — Critical
September 5 is the next immediate milestone. The Claims Portal is expected to become the principal customer interface, but a portal launch does not mean deposits, withdrawals or trading resume. A displayed balance also does not determine claim admission, legal priority or recovery amount.
Kraken — High
The September 1–5 forced-liquidation window remains active. CEXVia found no reliable venue-wide execution report in this run and therefore does not estimate an average customer discount.
Holdstation / UNO — High access risk in Thailand
This is not a confirmed global shutdown. Thailand SEC’s action is an access-blocking measure in Thailand from October 1. Because the SEC explicitly advises users to consider moving assets before the deadline, it is a real access-risk event.
BitMEX — High
No new status change today. The scheduled September 23 closure remains the key milestone.
③ Regulation and Licensing
ASIC — High
The September 30 no-action relief deadline is now a hard operating date for affected Australian digital-asset businesses.
Revolut — Medium / positive milestone
Conditional OCC approval moves Revolut closer to a U.S. national bank but does not yet permit the proposed bank to open.
Thailand Travel Rule — High
The rule is issued but does not take effect until February 27, 2027. The implementation window matters because firms must build information-transmission, due-diligence and self-hosted-wallet verification controls.
Singapore MAS — High, unchanged
No new material status beyond the ongoing stablecoin consultation.
④ Hacks, Vulnerabilities and Asset Loss
Aquifer — High
The whitehat deadline has passed. No qualifying return is publicly verified in the sources reviewed for this report. The loss remains an independent on-chain estimate.
Zilliqa — Critical
No new September 4 update changes yesterday’s partial-recovery status.
Injective — High
No new final technical post-mortem or official loss figure was identified.
ICON — High
No newer accounting supersedes the existing Foundation post-mortem.
⑤ User Complaints and Operational Anomalies
No new community-only complaint cluster met the threshold for a platform-wide High/Critical alert. Community claims about KYC, source-of-funds, account restrictions, withdrawal delays or suspected insolvency remain Community / Unverified unless independently corroborated.
⑥ On-chain and Market Anomalies
Aquifer remains the principal on-chain recovery watch. The question has shifted from exploit mechanics to whether attacker-linked assets move to exchanges, mixers, bridges or designated recovery addresses.
No separate flash-crash or depeg event identified in this run had enough corroborated risk significance for a standalone Detail.
⑦ Watchlist
| Date / Window | Event | What CEXVia Is Watching |
|---|---|---|
| Sep. 5 | AscendEX | Claims Portal launch / actual user functionality |
| Sep. 5 | Kraken | End of forced-liquidation window |
| Sep. 9 | BitMart | Restructuring / resumption roadmap |
| Mid-Sep | Zilliqa | Second hard fork + retail ZK migration |
| Sep. 23 | BitMEX | Trading closure |
| Sep. 30 | ASIC | Australian digital-asset licensing relief deadline |
| Sep. 30 | UK FCA | Crypto authorisation gateway opens |
| Oct. 1 | Holdstation / UNO | Thailand access blocking |
| Oct. 16 | MAS | Singapore stablecoin consultation closes |
| Feb. 27, 2027 | Thailand | Digital Asset Travel Rule takes effect |
⑧ No New Development Today, but Still High Risk
Cronos / Tectonic — Critical: final loss and bad-debt accounting remain unresolved.
BounceBit — Critical: old-chain migration and self-custody risks remain open after permanent chain sunset.
BitMart — Critical: September 9 remains the next major stated milestone.
Zilliqa — Critical: first exchange recovery is complete, but retail recovery and compensation remain unresolved.
Injective — High: no new official final loss or post-mortem today.
Rain / Avici / Tria — High: reimbursement is complete according to company disclosures, but final provider-wide technical accounting remains outstanding.
FAQ
What is the most important new regulatory risk on September 4?
ASIC’s final call is the strongest new licensing signal: affected Australian digital-asset firms have until September 30 to meet transition conditions.
Has Revolut received a full U.S. bank licence?
No. It has conditional OCC approval and still needs additional approvals before launch.
When does Thailand’s Travel Rule take effect?
February 27, 2027.
Will Holdstation and UNO shut down globally on October 1?
The confirmed action is Thailand access blocking, not a confirmed global shutdown.
Did Aquifer recover the stolen funds before the deadline?
No qualifying return was publicly verified in the reviewed sources. That does not prove no funds moved.
What is the next major CEX recovery deadline?
AscendEX’s September 5 Claims Portal target is the next immediate high-risk milestone.