Crypto Risk Monitor — September 23, 2026

September 23 is led by one hard centralized-exchange deadline and several regulatory or recovery developments that materially change the risk picture.

The most immediate operational event is BitMEX’s final exchange closure, scheduled for 04:00 UTC on September 23. At the closure time, all remaining open positions are scheduled to be force-closed and exchange trading will cease. Deposits sent after the cutoff will not be credited and BitMEX says they will not be recoverable. Withdrawals remain available after closure, but the platform becomes withdrawal-only and further technical restrictions begin on September 28. Verified balances left on the platform after closure also begin incurring the announced account fee. This is a scheduled strategic wind-down, not a confirmed insolvency, hack or emergency regulatory shutdown.

Read the Detail: BitMEX Exchange Closure

The largest new enforcement-development risk involves Binance and U.S. sanctions on Iran. Reuters reported on September 22 that U.S. federal prosecutors are investigating Binance in connection with Iran sanctions and trading activity on the exchange. The reported investigation is led by the U.S. Attorney’s Office in Manhattan and the Justice Department’s Criminal Division, with investigators examining whether Binance knowingly allowed trading that violated U.S. sanctions. Binance says it has zero tolerance for sanctions violations and fully cooperates with law enforcement. No charge, penalty or finding of wrongdoing has been announced in the current reporting, so CEXVia classifies this as High / Media-Developing, not a confirmed violation.

Read the Detail: Binance U.S. Iran Sanctions Investigation

The most important wallet-recovery update is Coldcard. White-hat operators moved 52.37 BTC linked to the July Coldcard exploit into an address associated with a recovery trust. Galaxy Digital research cited in current reporting says that amount represents 2.8% of total tracked exploit funds, and roughly 40% of Wave 2 is now believed to reflect white-hat activity rather than theft. Another 3.0134 BTC with no prior tracking history arrived in the same transaction and is suspected to be additional white-hat recovery, but that attribution is not yet confirmed. The move materially improves recovery prospects for some victims but does not resolve the broader incident, whose losses remain estimated rather than fully reconciled.

Read the updated Detail: Coldcard Hack Recovery Update

U.S. prediction-market regulation also tightened. The CFTC’s Division of Market Oversight issued a staff advisory on “mention markets”—event contracts whose outcome depends on whether an individual says specific words, appears at an event or interacts with another person. Staff says such contracts create a heightened manipulation risk because settlement can depend on conduct controlled by one person and may not be independently generated or externally verifiable. The advisory does not ban all mention markets, but it says they can be listed only in limited circumstances consistent with the Commodity Exchange Act and reminds designated contract markets that listed contracts cannot be readily susceptible to manipulation.

Read the Detail: CFTC Mention-Market Advisory

In Europe, the European System of Central Banks has recommended changes to MiCA’s stablecoin-reserve framework. Current MiCA rules require stablecoin issuers to keep at least 30% of reserve assets as bank deposits, rising to 60% for significant tokens. The ECB and EU national central banks argue fixed deposit floors can replace sticky retail deposits with more volatile stablecoin-issuer funding. Their consultation response recommends moving toward liquidity requirements based on assets maturing within one and five working days. The same policy response also pushes for stronger treatment of multi-issuance structures and, according to current reporting, broader restrictions on stablecoin yield generated through lending, borrowing and staking. These are recommendations under review, not rules that have already replaced MiCA.

Read the Detail: EU MiCA Stablecoin Reserve Review

A separate European market-structure development is now operational. The Eurosystem launched Pontes on September 21, allowing wholesale tokenized-asset transactions to settle in central-bank money by linking DLT market platforms to TARGET Services. An initial group of banks, public-sector financial institutions and DLT operators has already onboarded. The ECB has also begun preparatory work to invest a small portion of its own funds in tokenized euro-denominated public-sector and supranational securities, with settlement through Pontes. This is a wholesale institutional settlement rail, not a retail digital euro and not a public crypto exchange.

Read the Detail: ECB Pontes Tokenized Settlement

A broader cyber-risk item remains in the Daily Brief rather than becoming a CEXVia Detail. Microsoft said it disrupted EvilTokens, an AI-enabled phishing-as-a-service platform linked to more than 12,000 compromised inboxes across over 10,000 organizations. Microsoft, Coinbase, OpenAI, Cloudflare, TRM Labs and other partners participated in the disruption, which included seizure of 50 websites and disabling more than 150 additional domains. This matters to crypto firms because stolen mailbox sessions can be used for payment fraud, account recovery abuse and impersonation, but the incident is not itself a crypto-protocol exploit.

① Today’s Highest-Priority Alerts

② Exchange Exit / Shutdown / Withdrawal Risk

BitMEX — Critical / Final Trading Deadline

BitMEX is scheduled to close exchange operations at 04:00 UTC today. Any remaining open position at that time will be force-closed using the relevant settlement price or index. Users who close positions before the deadline retain more control over execution timing and price.

Deposits are credited only until the closure time. BitMEX explicitly says deposits sent afterward will not appear in account balances and will not be recoverable.

Withdrawals remain available after the exchange closes. Users can still log in to view balances, transaction history and withdrawal pages, but trading and discontinued exchange functions disappear. From September 28 at 04:00 UTC, API withdrawals—including institutional workflows such as Fireblocks and Copper integrations—are disabled, and USDT, USDC and ETH multi-network withdrawal fungibility is removed.

Verified balances left on BitMEX after closure are charged an account fee equal to 1% per annum or $50 equivalent, whichever is greater, deducted from the existing balance. Small balances can therefore be reduced to zero over time.

CoinEx — Critical / Continuing

No new material development changes yesterday’s shutdown framework. September 29 remains the important cutoff for spot trading and for users who want non-USDT assets in original token form.

WOO X — High / Continuing

CKB, ICP and MERL are now in the withdrawal-only period after the September 22 trading cutoff. Withdrawal/wallet support is scheduled to end September 24 at 02:00 UTC.

③ Regulation and Licensing

Binance / Iran sanctions — High / Developing

The reported investigation is the most important enforcement development. It concerns whether Binance knowingly permitted trading that breached U.S. Iran sanctions.

The current evidence does not establish:

• that Binance has been charged;
• that prosecutors have concluded the exchange knowingly violated sanctions;
• that the investigation is complete.

Historical U.S. enforcement against Binance remains relevant context but cannot be used as proof of the current allegations.

CFTC Mention Markets — High

The staff advisory directly raises the listing standard for event contracts whose settlement can be influenced by an individual’s own speech or behavior. DCMs must consider manipulation risk and provide contract-specific analysis under Part 40.

EU Stablecoin Rules — Medium

The ESCB consultation position would replace a fixed bank-deposit allocation with a liquidity-maturity framework and strengthen safeguards around multi-issuance structures. Current MiCA requirements remain operative unless and until EU legislation changes.

ECB Pontes — Medium

Pontes is now operating as wholesale settlement infrastructure. It expands regulated tokenized-market plumbing rather than authorizing public crypto trading.

④ Hacks / Vulnerabilities / Asset Loss

Coldcard — Critical / Recovery Improving

The 52.37 BTC transfer is a recovery milestone, not a new exploit.

Current reporting says the amount represents 2.8% of tracked exploit funds and that approximately 40% of Wave 2 activity has now been identified as white-hat rather than malicious. An additional 3.0134 BTC may also be recovered Coldcard funds, but that classification remains unconfirmed.

The original failure involved weak software-derived randomness being used for wallet seed generation rather than the dedicated hardware random-number source. Firmware has been patched, but old exposed seeds remain unsafe regardless of firmware updates.

EvilTokens — Medium Ecosystem Cyber Risk

Microsoft says the platform used device-code phishing to obtain persistent mailbox access and AI to identify payment relationships, trusted contacts and fraud opportunities. For exchanges, custodians and treasury teams, the key lesson is that email compromise can accelerate social engineering against withdrawal approvals, account recovery and vendor-payment workflows.

⑤ User Complaints / Operational Anomalies

No new Community-only complaint cluster met the threshold for a platform-wide High/Critical alert.

BitMEX complaints after the closure time should be categorized carefully:

• inability to trade is expected after the announced closure;
• deposits after 04:00 UTC are explicitly warned as unrecoverable;
• withdrawals remain supported, subject to the published technical changes.

Coldcard recovery claims should likewise be handled cautiously. A recovery trust process creates phishing opportunity, and unsolicited messages asking victims to reveal seeds or private keys should remain Community / Unverified until independently verified.

⑥ On-chain and Market Anomalies

Coldcard is today’s clearest on-chain recovery anomaly. The important change is not another attacker sweep but reclassification of part of the historical flow as white-hat custody for restitution.

Mention markets represent a different form of market-integrity anomaly: a contract can be economically manipulated without changing an external asset price if a person whose behavior determines settlement can intentionally alter that behavior.

EU stablecoin reserve reform also changes the risk lens from “where are reserves held?” toward “how fast can reserves be turned into cash without destabilizing banks or the token?”

⑦ Watchlist

⑧ No New Development Today, but Still High Risk

D’CENT App Wallet — Critical: final multi-chain loss and technical root cause remain unresolved. Nostra — Critical: bad-debt reconciliation, recovery and money-market reopening remain unresolved. ASI / SingularityNET cluster — Critical: key-compromise remediation and unauthorized token-supply accounting remain active. Symbiosis — Critical: native Bitcoin Bridge remains offline while rewrite, audit and compensation continue. Splash / OADA — Critical: recovery, liquidity restoration and compensation remain unresolved. BitMart — Critical: no verified recovery percentage or date-certain withdrawal timetable.

FAQ

What is the most urgent user deadline today?

BitMEX’s 04:00 UTC exchange-closure time, when remaining positions are scheduled to be force-closed and trading stops.

Has Binance been charged over the new Iran-sanctions investigation?

No charge or finding of wrongdoing has been announced in the current reporting.

How much Coldcard BTC moved to the recovery trust?

52.37 BTC linked to the exploit was moved into the recovery-trust address; another 3.0134 BTC may be additional white-hat recovery but is not yet confirmed.

Did the CFTC ban all mention markets?

No. Staff says these contracts present heightened manipulation risk and can be listed only in limited circumstances consistent with existing law and regulations.

Has MiCA’s stablecoin reserve rule already changed?

No. The ESCB has recommended changes, but the current framework remains in force unless EU legislation is amended.

Is Pontes the retail digital euro?

No. Pontes is wholesale settlement infrastructure for tokenized financial transactions using central-bank money.