The Evening Brief: Clarity Act dies in Senate; Arc launches with Wall Street; Iran sanctions enforcement escalates

The Senate voted 49-50 on September 15 against advancing the Digital Asset Market Clarity Act, blocking the first comprehensive federal crypto market structure after a year of bipartisan negotiation. Four Senate Republicans, Susan Collins, Josh Hawley, Jerry Moran, and Thom Tillis, joined all Democrats to defeat a cloture motion. The core dispute centered on ethics provisions governing financial interests held by President Trump and his administration in crypto ventures while overseeing regulation. Seven Democrats who had shaped the bill voted against it, citing language they said did not adequately prevent sitting officials from profiting off the industry they regulate. Republicans presented the ethics text as final; Democrats refused to move without enforcement mechanisms the party viewed as substantive. The bill is dead unless a second cloture vote occurs by October 5 during the state work period; otherwise revival requires a new Congress in 2027. The outcome leaves the regulatory question unresolved: crypto oversight remains split between the SEC and CFTC with no statutory clarity on asset classification or validator liability.

Circle's Arc mainnet launches on September 16 with 11 named founding validators drawn from Wall Street and payments infrastructure: BlackRock, DTCC, Visa, Mastercard, ICE, and Circle itself, alongside six ecosystem partners. The validators operate a permissioned Proof-of-Authority consensus in which a rotating validator proposes a block and more than two-thirds of the validator set must pre-commit to finalize it. Arc's critical structural choice is a liability wall: neither the validators nor Arc Network Services LLC bear responsibility for third-party applications or assets deployed on the network. According to the desk's reporting, about 20 SOC 2-certified validators across multiple regions are expected in the launch configuration, more than the 12 organizations publicly identified. Individual validator voting weights remain undisclosed at launch. Circle has agreed to either deliver the ARC token or transition the network to Proof-of-Stake by May 2028, or face demands for repayment from presale investors who bought 807.5 million tokens at 30 cents each. BlackRock was among the presale cohort and is expected to deploy its BUIDL money-market fund on Arc. DTCC is both a founding validator and a planned integration partner, with DTC-custodied asset connection targeted for the second half of 2027.

Federal enforcement against Iran-linked crypto activity escalated on September 15. The DOJ filed a civil forfeiture complaint seeking $61 million in cryptocurrency allegedly tied to Iran's black-market crude oil sales and destined for the Islamic Revolutionary Guard Corps. Prosecutors identified a $1.5 billion underground pipeline that moved black-market Iranian oil proceeds through unhosted wallets, with two China-based companies, Blessed Trust and Hexa Whale, allegedly coordinating the majority of transfers through Binance trading accounts. The civil forfeiture action requires only a preponderance of evidence, a lower threshold than criminal conviction, and does not allege wrongdoing by Binance itself. Binance pleaded guilty in 2023 to sanctions violations and agreed to a $4.3 billion settlement; the current complaint suggests post-settlement monitoring did not catch fresh Iran-linked activity. Separately, the DOJ charged two Robinhood engineers, Hefu Chai and Huaisong Xiang, with wire fraud and commodities fraud for trading perpetual futures on the decentralized platform Hyperliquid using nonpublic information about cryptocurrency listings the company was preparing to announce. Each defendant allegedly earned more than $50,000 from the trades between 2025 and 2026.

Other developments tied to settlement and security infrastructure moved forward. Balancer's governance forum posted a shutdown proposal on September 14, recommending the protocol wind down and distribute its approximately $9 million treasury to BAL token holders through staged redemptions between May 2027 and July 2028. The proposal follows a failed April restructuring: monthly protocol revenue fell to $30,000 in August against monthly burn of $150,000, crossing the $60,000-per-month threshold that triggered an automatic governance review. A Snapshot vote is scheduled for September 25-29. India's Securities and Exchange Board announced Demat 2.0 on September 10, a pilot that moved ₹1,025 crore in tokenized corporate bonds using atomic delivery-versus-payment with the Reserve Bank of India's wholesale digital rupee. Three issuers, REC, L&T, and IIFL, completed offerings on September 7 and 9; retail participation and secondary-market trading are deferred to a later stage. The House Ways and Means Committee released H.R. 10357, a 114-page Digital Asset Tax Certainty Act, on September 14, with formal committee markup set for September 16. The bill proposes a $10 exemption for blockchain transaction fees below that threshold, applicable only to users executing fewer than 5,000 transfers annually. The SEC's crypto custody rule rewrite entered White House OMB review on August 25, targeting October 2026 for a notice of proposed rulemaking.

Security incidents exposed operational risks. Revolut disclosed a data theft affecting a "very limited" number of customers after attackers impersonated a government agency to bypass its information-request controls. Customer notifications referenced account statements, IBANs, withdrawal records, and full transaction histories including Bitcoin activity, alongside passport copies and driving licenses. The attackers are demanding 10,000 BTC, roughly $780 million, in ransom and threatening daily data releases; Revolut has not authenticated the demand or confirmed the leaked material. A $0.25 deposit to the Symbiosis Bitcoin Bridge became 46.1 billion fake syBTC tokens, more than 2,000 times Bitcoin's entire supply, through two compounding software bugs: one that misread transaction data to treat the attacker as both an approved depositor and the bridge administrator, and a second that permitted negative fees, turning subtraction into addition. Symbiosis' bridge is offline pending security review; preliminary losses are estimated at 9.97 BTC, approximately $770,000. An MEV bot named Yoink intercepted an exploit targeting a Safe wallet on Ethereum on September 15, front-running an attacker and capturing approximately $7.81 million in rsETH. The vulnerability was in a user-enabled executor contract, not Safe's core protocol. CoinEx, a Hong Kong-based crypto exchange, announced closure in December after nine years, citing falling trading volumes, prolonged downturn, and rising compliance costs. Founder and CEO Haipo Yang rejected a sale in favor of liquidation.