Crypto Risk Monitor — September 9, 2026

September 9 is a recovery-and-regulation day rather than a new large-scale exchange failure day.

The most important security development remains Liquid Network, but the risk picture has materially improved from the initial September 6 incident. The actor who withdrew roughly 4,000 BTC has returned 3,400 BTC after Blockstream said the affected bridge nodes had been patched. Approximately 598.5 BTC remains under the actor’s control. The retained balance should not be described as an agreed or formally approved bounty unless Blockstream or Liquid confirms such terms. The correct status is: partial recovery confirmed / remaining BTC unresolved / normal bridge operations not yet fully restored in reviewed updates.

Read the updated detail: Liquid Network 4,000 BTC Incident

Australia has also produced a major new regulatory signal. AUSTRAC says it cancelled, suspended or refused renewal for 45 remittance and virtual-asset service provider registrations over the past year. The regulator cited causes including inactivity, insolvency, lack of operational capability, inappropriate registration, failure to report material changes and significant money-laundering or terrorism-financing risk. This is not one enforcement action against 45 crypto exchanges; it is a portfolio of registration actions across remittance and VASP businesses.

Read the detail: AUSTRAC Removes 45 Remittance and VASP Registrations

A new U.S. market-structure development is Block’s application to establish Builders Bank & Trust, N.A. Block says the proposed entity would be an uninsured, non-deposit-taking national trust bank under OCC supervision and would provide custody and fiduciary services, including for bitcoin and stablecoins. It would not accept deposits or make loans. The application is not an approval.

Read the detail: Block Builders Bank & Trust OCC Application

The Cronos / Tectonic incident also has a major accounting update. A Cronos post-mortem reported publicly says the chain rollback reversed approximately $111.2 million tied to the exploit by discarding roughly 1 hour and 54 minutes of transaction history, including unrelated legitimate activity. Approximately $9.19 million had already left the network and remained unrecovered in that accounting.

Read the updated detail: Cronos / Tectonic Exploit

Today also contains a hard centralized-exchange asset-access deadline. Binance ends normal withdrawals for ALCX, ARDR, NFP and POND at September 9, 03:00 UTC. Binance says the delisted tokens may later be converted to stablecoins on behalf of users, but such conversion is not guaranteed.

Read the detail: Binance ALCX, ARDR, NFP and POND Withdrawal Deadline

A second exchange deadline occurs at CoinEx, where WAVES margin positions and the WAVESUSDT perpetual contract are scheduled for automatic closure/delisting at September 9, 03:00 UTC.

Finally, BitMart’s restructuring roadmap is due by September 9 under its latest official notice. At the time of this report, the reviewed official page still contains the earlier commitment to provide a further update by no later than September 9, but no newer roadmap was identified. CEXVia keeps BitMart in the Watchlist without declaring a missed deadline while September 9 is still in progress.

① Today’s Highest-Priority Alerts

② Exchange Exit, Shutdown and Withdrawal Risk

Binance — High

ALCX, ARDR, NFP and POND reach the final normal-withdrawal cutoff at 03:00 UTC. Binance may later convert balances into stablecoins, but conversion is explicitly not guaranteed.

CoinEx — High

WAVES margin and perpetual positions are scheduled for automatic closure at 03:00 UTC. Spot trading/deposit termination for the broader group follows September 11, while withdrawals remain open until December 11.

BitMart — Critical

September 9 is the promised date for a further restructuring/resumption update. The latest verified notice describes a potential phased resumption alongside distributions to creditors and confirms White & Case as restructuring counsel.

AscendEX — Critical

No verified restoration of normal withdrawals or confirmed claims-portal launch was identified.

Orionx — Critical

Permanent shutdown, frozen withdrawals and the customer-asset custody gap remain unresolved.

③ Regulation and Licensing

AUSTRAC — High

AUSTRAC’s 45 registration actions show a harder AML perimeter for remittance and VASP businesses.

Block / OCC — Medium

Block’s national trust-bank application is a market-structure development, not a granted licence.

ASIC — High

Australia’s September 30 digital-asset licensing transition deadline remains in force.

Pakistan / PVARA — High

The September 5 NOC deadline has passed; operator-by-operator outcomes remain incomplete.

④ Hacks, Vulnerabilities and Asset Loss

Liquid Network — Critical

The incident has moved from acute reserve drain to partial recovery. The remaining ~598.5 BTC, technical root cause, reserve reconciliation and bridge restart remain unresolved.

Cronos / Tectonic — Critical

The key new fact is a better separation of gross exploit activity from what was actually reversed and what remains unrecovered.

Notional — High

No final official post-mortem supersedes the independent loss estimate.

Vesu / Pragma — High

Refund/recovery work remains developing.

⑤ User Complaints and Operational Anomalies

No new Community-only complaint cluster independently met the threshold for a platform-wide High/Critical alert.

Claims about BitMart recovery percentages, AscendEX priority, Liquid bounty terms or Orionx repayment percentages remain Community / Unverified unless supported by official or independently verifiable evidence.

⑥ On-chain and Market Anomalies

Liquid remains the largest live on-chain monitoring item: 3,400 BTC is back in federation custody, but roughly 598.5 BTC remains outside.

Tectonic’s chain rollback is a separate market-structure anomaly because it reversed not only attacker transactions but also approximately 1 hour and 54 minutes of unrelated chain history.

Binance and CoinEx today show another type of market-access risk: exchange-controlled deadlines can turn an ordinary token holding into a non-tradable, non-withdrawable or automatically liquidated balance.

⑦ Watchlist

⑧ No New Development Today, but Still High Risk

Orionx — Critical: permanent shutdown and custody shortfall remain unresolved. AscendEX — Critical: withdrawals remain suspended and claims access remains uncertain. GoMining-linked wallets — High / Developing: no final official root-cause confirmation. Coldcard — Critical: stolen-fund laundering remains active across chains. Aquifer — High: no verified qualifying recovery after the whitehat deadline. Zilliqa — Critical: retail migration and compensation governance remain pending. Router Protocol — High: September 30 shutdown and exchange-specific delisting timelines remain ahead.

FAQ

What is the most important change today?

Liquid recovered 3,400 BTC, materially reducing the immediate reserve deficit, although ~598.5 BTC remains unresolved.

Is the remaining 598.5 BTC an officially agreed bounty?

Not in the evidence reviewed for this report.

Did AUSTRAC ban 45 crypto exchanges?

No. AUSTRAC took registration actions against 45 remittance and VASP businesses for multiple reasons.

Does Block already have a national trust bank?

No. It has applied to the OCC.

What is the updated Tectonic unrecovered amount?

The latest publicly reported Cronos post-mortem says approximately $9.19M remained unrecovered in that accounting.

What happens to ALCX, ARDR, NFP and POND on Binance today?

Normal withdrawal support ends at 03:00 UTC; later stablecoin conversion is not guaranteed.