The Evening Brief: Governance attack halts Cosmos; stablecoin partnerships expand

Cosmos Hub came to a halt on Tuesday after a low-cost governance attack on Neutron, a Cosmos-ecosystem chain, drained $9.5 million from two applications. The attacker spent just $20,199 to acquire NTRN tokens needed to pass a malicious proposal, gaining control of Astroport and Drop and extracting approximately $4.9 million and $4.4 million respectively before network pauses trapped most of the stolen funds. Cosmos Hub validators halted block production for over 24 hours, securing 1.2 million ATOM held in the attacker's address before resuming at 12:00 UTC on Wednesday. Per Protos, the attacker was able to extract only about 20 percent of the $9.5 million total; the remainder remains stuck on halted networks. This marks the third security incident in recent months for Cosmos: a bug in Cosmos Labs' EVM module caused losses across four blockchains in late August, and Osmosis revealed in early September that a June 25 bridge exploit had minted 40 nBTC out of thin air, leaving its allBTC pool 36 percent unbacked.

While Cosmos grappled with governance design vulnerabilities, stablecoin adoption across traditional and emerging infrastructure accelerated. Binance purchased $100 million in equity in Circle, the USDC issuer, and committed to a five-year commercial arrangement under which Circle will pay Binance monthly incentive fees tied to USDC held through Binance's Modular Smart Contract Wallet, according to the desk's reporting. The deal closed September 17 and ties the exchange's profitability directly to stablecoin distribution. Separately, Canada's six largest banks are launching a shared tokenized deposit platform to modernize interbank clearing, per CoinDesk, with testing beginning on digital commercial deposits across participating institutions before any integration with broader digital asset ecosystems. In Europe, Raiffeisen Bank International is rolling out bitcoin trading across 11 markets via Bitpanda, expanding a 2024 pilot by a Raiffeisen subsidiary that became the first traditional EU bank to offer crypto trading within its banking environment. On the U.S. side, Blockchain.com and NYSE Group signed a memorandum of understanding on September 23 to offer Blockchain.com's 44 million users access to tokenized U.S. stocks and ETFs through NYSE's planned digital alternative trading system, subject to regulatory approvals.

Regulatory moves, however, continue to constrain the pace of stablecoin yield expansion. European central banks are pushing for an amendment to MiCA that would restrict indirect yield structures embedded in crypto lending and staking products, not only direct yields, per the desk's reporting. Central bankers argue these mechanisms blur the line between payment tokens and bank deposits and risk deposit flight from traditional banking. The advisory is not binding, but the operational definition of what constitutes an "indirect yield" and how regulators would enforce such restrictions remains unresolved. In the U.S., the CFTC's Division of Market Oversight issued an advisory on September 22 flagging prediction market contracts settling on whether a named individual says certain words, attends events, or interacts with others as presenting heightened manipulation risk. Per Decrypt, the advisory does not ban such contracts but sets conditions for listing them; the presumption of manipulation can be rebutted if exchanges can design mention markets that meet CFTC standards.

Two protocol upgrades are moving toward activation. Solana has begun testing the Alpenglow upgrade on testnet, which would cut transaction finality from 12.8 seconds to 150 milliseconds, enabling near-instant settlement for payments and bridges, per CoinDesk. The XRP Ledger is targeting an October 5 activation date for a network upgrade enabling delegated payment authority, allowing businesses to grant limited powers such as payments or approvals without transferring full account control, per CoinDesk. Geopolitically, Saudi Arabia has ended its participation in mBridge, a China-backed cross-border CBDC platform, after completing a proof of concept in May 2025, according to Cointelegraph's reporting. The exit signals friction within the de-dollarization coalition and reshapes CBDC alignment as the U.S. continues to scrutinize alternative multilateral payment infrastructure.

On-chain recovery proceeded following a Coldcard vulnerability: white-hat actors moved 52 bitcoin to a Wyoming trust operated at cryptorecoverytrust.com to facilitate victim restitution, per CoinDesk and Cointelegraph. The recovered funds represent a portion of the total exploit; the key variable is what percentage the 52 BTC represents of the total breach and how efficiently the recovery trust can verify and process victim claims.

The desk's boards show bitcoin down 0.3 percent on the day but up 11.8 percent on the week and 35.1 percent on the month, with the board recording bitcoin at $86,352.20. Ethereum is down 0.5 percent on the day, up 9.3 percent on the week, and up 47.5 percent on the month, at $2,760.97. On leverage, the desk's OKX data shows BTC funding rates neutral at -0.9 percent annualized, with a 1.16 long-to-short ratio and $2.48 trillion open interest; ETH funding rates are slightly positive at 1.4 percent annualized with a 1.44 long-to-short ratio. ETF flows show net inflows continuing: bitcoin ETF flows recorded $32.4 million inflow on the day and $2,338.6 million net inflow over the last five sessions; ethereum ETF flows recorded $1.6 million inflow on the day and $538.2 million net inflow over the last five sessions. Whale flows on the desk's 24-hour Whale Watch board show $223.7 million moving onto exchanges net, led by $281.3 million in ethereum moving onto Coinbase and $55.3 million in bitcoin moving onto Coinbase, offset by $92.8 million in bitcoin moving off Coinbase Institutional. Weekly whale flow data show a reversal: the week ending September 2 saw $371 million move off exchanges; the week ending September 23 shows $1.048 billion moving onto exchanges.