September 12 does not bring a new nine-figure exchange hack, but it does produce several material changes across infrastructure recovery, crypto-financial-services operations, exchange asset access and tokenized-market infrastructure.
The highest-priority technical event remains Liquid Network. The sidechain has moved further from emergency shutdown toward controlled recovery: block production resumed after emergency updates, but normal user transactions and BTC/L-BTC peg operations remain restricted in the latest verified state. The risk therefore shifts from “active drain” to “controlled restart with incomplete economic functionality.” The distinction matters because a network can technically produce blocks while users still cannot rely on normal settlement or redemption.
Read the update: Liquid Network Controlled Restart
A separate security problem has emerged around the same incident: Blockstream is warning about active impersonation and phishing campaigns using Liquid/Blockstream branding. Attackers are reportedly sending messages telling users to “update portfolios,” “check reimbursement,” “re-peg assets,” install software or enter recovery phrases. Blockstream explicitly says users do not need to move funds or enter recovery phrases because of the Liquid incident. This is a distinct social-engineering event and should not be merged with the underlying bridge exploit.
Read the detail: Liquid / Blockstream Phishing Campaign
Operationally, Bitcoin Suisse announced one of the largest staffing restructurings among major regulated crypto-financial-service providers this week. The Swiss company plans to cut up to 60 of 120 Swiss roles, while consolidating software development and back-office functions into international hubs and closing its Copenhagen IT development site. The company frames the move as international scaling rather than distress. There is currently no evidence in the reviewed material of a withdrawal freeze, custody shortfall or insolvency. CEXVia therefore classifies this as Medium operational risk, not a solvency event.
Read the detail: Bitcoin Suisse Operational Restructuring
CoinEx has also announced a new 14-asset delisting cycle covering MLN, XEM, GENSYN, FIDA, LISTA, RAIL, ACS, 0G, L3, ROAM, SPELL, MITO, PI and PYR. XEM margin lending has already begun shutting down, XEM margin trading ends September 15, deposits and spot trading for the full group end September 17, and withdrawals end December 17. This is not an immediate September 12 withdrawal cutoff, but it is a newly announced asset-access lifecycle that requires advance user action.
Read the detail: CoinEx 14-Asset Delisting Cycle
The most important market-structure development is Nasdaq’s agreement to invest $100 million in Payward, Kraken’s parent company, while expanding work on Nasdaq Equity Tokens and market-surveillance infrastructure. Nasdaq says the partnership is intended to support tokenized equities and always-on markets while preserving governance, regulatory compliance and market integrity. The risk significance is not that the partnership is negative; it is that traditional securities infrastructure and crypto trading rails are converging, increasing the importance of surveillance, shareholder-rights mapping, settlement design and regulatory perimeter clarity.
Read the detail: Nasdaq–Kraken Tokenized Equity Infrastructure
Existing high-risk events remain active. BitMart still has no verified reserve inventory, recovery percentage or date-certain withdrawal plan after appointing Alvarez & Marsal. Nomic/Osmosis remains a backing/governance case. Orionx remains in permanent shutdown with restitution uncertainty. AscendEX remains a claims-access and withdrawal-recovery case.
① Today’s Highest-Priority Alerts
| Risk | Entity | Event | Time | Latest Status | Evidence Type | Continue Monitoring | New vs Previous Day |
|---|---|---|---|---|---|---|---|
| Critical | Liquid Network | Controlled recovery after ~4,000 BTC incident | Sep. 10–12 | Block production resumed; normal transactions and peg operations still restricted | Official/Media + On-chain | Yes | Recovery phase continues |
| High | Liquid / Blockstream users | Phishing / impersonation campaign | Sep. 9–12 | Fake support, reimbursement, re-peg and software-install lures active | Official | Yes | New independent security threat |
| Medium | Bitcoin Suisse | Operational restructuring | Sep. 11 | Up to 60 of 120 Swiss roles may be cut; Copenhagen IT site closing; consultation to Sep. 20 | Company via Reuters/Media | Yes | New operational restructuring |
| High | CoinEx | 14-asset delisting cycle | Announced Sep. 10 | XEM margin shutdown begins; full trading/deposit stop Sep. 17; withdrawal cutoff Dec. 17 | Official | Yes | New asset-access cycle |
| Medium | Nasdaq / Payward / Kraken | Tokenized-equity market infrastructure | Sep. 10–12 | $100M investment agreement; NET framework and surveillance integration advance | Official | Yes | New market-structure development |
| Critical | BitMart | Restructuring / withdrawals | Ongoing | Adviser review underway; reserve/recovery metrics not published | Official | Yes | No material new disclosure |
| Critical | Nomic / Osmosis | nBTC backing incident | Ongoing | Backing restoration and governance remain unresolved | Protocol/Media + On-chain | Yes | No major new verified update |
| Critical | Orionx | Permanent shutdown / custody shortfall | Ongoing | Withdrawals suspended; restitution unresolved | Company/Regulator/Media | Yes | No major new verified update |
② Exchange Exit / Shutdown / Withdrawal Risk
CoinEx — High
The new 14-asset delisting cycle is today’s clearest newly announced CEX asset-access event. The key dates are September 15 for XEM margin, September 17 for deposits/trading, and December 17 for withdrawals.
BitMart — Critical
No verified reserve table, liabilities schedule, recovery percentage or withdrawal timetable has been published after the adviser appointment.
AscendEX — Critical
Normal withdrawal recovery remains unverified in the material reviewed.
Orionx — Critical
Permanent shutdown and customer-asset restitution remain unresolved.
Kraken / Bitrue / Phemex — High, ongoing from yesterday
September 11 trading and product shutdowns have already taken effect or entered their execution phase. The next risk is now withdrawal completion and settlement rather than the trading halt itself.
③ Regulation and Licensing
Nasdaq / Kraken market structure — Medium
The Nasdaq-Payward agreement deepens the convergence of regulated securities infrastructure and crypto-native venues. Surveillance, shareholder rights, settlement design and legal ownership become more important as tokenized equity products scale.
ESMA — Medium, ongoing
ESMA’s latest risk-monitoring position remains relevant: crypto/TradFi interconnection is increasing and DeFi exploits can create spillover risk.
India FIU — High, ongoing
The takedown and PMLA action against 15 offshore VASPs remains a market-access risk.
AUSTRAC / ASIC — High, ongoing
AUSTRAC’s 45 registration actions and ASIC’s September 30 licensing transition remain active Australian compliance risks.
④ Hacks / Vulnerabilities / Asset Loss
Liquid Network — Critical
Technical recovery is progressing, but bridge and redemption functions are not fully normalized.
Liquid / Blockstream phishing — High
The post-incident phishing wave is a separate user-loss vector. The official instruction is not to enter seed phrases, PINs or install recovery software sent through unsolicited messages.
Nomic / Osmosis — Critical
Backing restoration remains incomplete.
XRP Healthcare — High
The weak key-generation incident remains unresolved until all affected wallets migrate and recovery efforts conclude.
⑤ User Complaints / Operational Anomalies
No new Community-only cluster independently met the threshold for a platform-wide High/Critical event.
Claims of guaranteed BitMart recovery rates, guaranteed Nomic reimbursement, guaranteed return of the remaining Liquid BTC, or “official” Liquid reimbursement portals remain Community / Unverified unless confirmed through authoritative channels.
⑥ On-chain and Market Anomalies
Liquid remains the largest active infrastructure anomaly because consensus has resumed while ordinary economic activity remains constrained.
CoinEx’s new delisting cycle creates future asset-access concentration risk, especially for holders who wait until the December withdrawal deadline.
Nasdaq’s Payward investment is a market-structure signal rather than a security incident: tokenized equities are moving closer to established exchange infrastructure, and the associated surveillance and legal-ownership model will matter increasingly.
⑦ Watchlist
| Date / Window | Event | What CEXVia Is Watching |
|---|---|---|
| Immediate | Liquid | Transaction reopening, peg reopening, reserve reconciliation |
| Immediate | Liquid phishing | New fake domains, wallet-drain reports, impersonator infrastructure |
| Sep. 15 03:00 UTC | CoinEx / XEM | Margin trading shutdown |
| Sep. 17 08:00 UTC | CoinEx | Deposits/trading stop for 14 assets |
| Sep. 20 | Bitcoin Suisse | End of Swiss staff consultation period |
| Sep. 23 | BitMEX | Trading closure |
| Sep. 24 | Binance USDP | Spot trading end |
| Sep. 30 | Router Protocol | Operations wind-down |
| Sep. 30 | ASIC | Australia licensing transition deadline |
| Oct. 1 | Holdstation / UNO | Thailand access blocking |
| Dec. 10–17 | Multiple CEX | Withdrawal deadlines for several delisted assets |
⑧ No New Development Today, but Still High Risk
BitMart — Critical: no verified recovery percentage or withdrawal timetable.
Nomic / Osmosis — Critical: collateral/backing recovery remains pending.
Orionx — Critical: permanent shutdown and custody shortfall unresolved.
AscendEX — Critical: claims and withdrawal recovery remain uncertain.
Coldcard — Critical: stolen-fund laundering remains active across chains.
GoMining-linked wallets — High / Developing: no final official root-cause confirmation.
Zilliqa — Critical: retail migration and compensation governance remain pending.
FAQ
Is Liquid Network fully operational again?
No. Block production has resumed, but normal user transactions and peg operations are still not fully restored in the latest verified state.
Is there a separate phishing risk related to Liquid?
Yes. Blockstream has warned about impersonators using fake security updates, reimbursement pages and recovery requests.
Is Bitcoin Suisse insolvent?
There is no evidence in the reviewed material of insolvency, withdrawal suspension or a custody shortfall. The announced move is an operational restructuring.
Which CoinEx assets are in the new delisting cycle?
MLN, XEM, GENSYN, FIDA, LISTA, RAIL, ACS, 0G, L3, ROAM, SPELL, MITO, PI and PYR.
Why is Nasdaq’s Payward investment in a risk report?
Because tokenized securities are moving closer to mainstream market infrastructure, increasing the importance of surveillance, settlement design, shareholder rights and regulatory perimeter clarity.
What is today’s biggest immediate user-security action?
Ignore unsolicited Liquid/Blockstream recovery messages and never provide recovery phrases, PINs or install software from unsolicited links.