Key takeaways

• Bitcoin traded near $75,950 after falling more than 1% on Tuesday.
• Ethereum and XRP declined more than 4% and 9%, respectively.
• BTC remains above its 50-day, 100-day, and 200-day EMAs.

Bitcoin (BTC) traded near $75,950 on Wednesday after declining more than 3% during the previous session as the CLARITY Act failed to advance in the US Senate.

Ethereum and XRP suffered steeper losses, falling more than 4% and 9%, respectively. Despite the market-wide pullback, Bitcoin remains above its major exponential moving averages, preserving its broader bullish structure.

Traders now await the Federal Reserve’s interest-rate decision and Chair Kevin Warsh’s forward guidance, which could determine the cryptocurrency market’s next major move.

CLARITY Act failure pressures crypto prices

The cryptocurrency market weakened on Tuesday after the CLARITY Act failed to secure sufficient support to advance in the Senate.

The setback reduced expectations that Congress would soon establish a comprehensive regulatory framework for the US digital-asset market. Bitcoin fell more than 3%, while greater selling pressure across altcoins pushed Ethereum and XRP sharply lower.

Prices stabilized on Wednesday, but uncertainty surrounding US monetary policy kept buyers cautious.

The Federal Reserve’s rate decision and subsequent guidance could influence liquidity expectations, Treasury yields, and demand for risk assets. A more restrictive outlook could extend the crypto market’s correction, while a less hawkish message may support a recovery.

Bitcoin maintains bullish EMA structure

Bitcoin continues to trade above its 50-day, 100-day, and 200-day exponential moving averages, which are clustered between approximately $71,400 and $73,600.

The 50-day EMA stands at $73,581, while the 200-day EMA is positioned slightly lower at $73,108. The 100-day EMA provides additional support at $71,391.

This configuration remains constructive because BTC is trading above all three averages and the shorter-term 50-day EMA remains above the longer-term indicators.

However, Bitcoin must defend this support cluster to prevent the recent pullback from developing into a deeper correction.

Bitcoin’s Relative Strength Index has slipped to approximately 49, placing it near neutral territory.

The reading indicates that neither buyers nor sellers have established strong momentum. However, the decline from higher levels shows that bullish demand has weakened following Tuesday’s sell-off.

The Moving Average Convergence Divergence indicator remains negative and below the zero line. This suggests that Bitcoin’s broader bullish structure is still intact, but short-term momentum currently favors consolidation or further downside.

The 50-day EMA at $73,581 represents Bitcoin’s first important support level. If sellers push BTC below that level, the 200-day EMA at $73,108 could provide the next line of defense. A deeper correction would place the 100-day EMA at $71,391 in focus.

Failure to hold the entire moving-average cluster could expose the lower horizontal support levels at $66,500 and $62,300.

On the upside, Bitcoin faces significant resistance near $85,000. A sustained recovery above that barrier would signal renewed bullish strength and potentially restart the broader uptrend.

Key takeaways

• ETH traded near 0.03167 BTC as its performance against Bitcoin weakened.
• A potential double top has formed with two peaks around 0.03344 BTC.
• A close below the 0.03078 BTC neckline could trigger a 10% decline toward 0.0283 BTC.

Ethereum is showing signs of further underperformance against Bitcoin as a potential double-top pattern develops on the ETH/BTC daily chart.

Ether traded near 0.03167 BTC on September 16 after failing to sustain its latest advance. Weakening momentum, growing regulatory uncertainty, and a sharp increase in ETH deposits to Binance support a cautious near-term outlook.

A confirmed breakdown below 0.03078 BTC could send the pair approximately 10% lower toward 0.0283 BTC.

ETH/BTC double top signals potential decline

The ETH/BTC chart has formed two comparable peaks near 0.03344 BTC, with the first appearing in August and the second in September.

This structure resembles a double top, a bearish reversal pattern that develops when buyers repeatedly fail to break through the same resistance level.

The pattern’s neckline sits near 0.03078 BTC. Ethereum would need to record a decisive daily close below this level to confirm the bearish setup.

Subtracting the pattern’s height from the neckline produces a downside target around 0.0283 BTC. Reaching that level would represent an approximately 10% decline from Ether’s current value against Bitcoin.

Ethereum momentum weakens

The ETH/BTC Relative Strength Index has fallen toward 50 after previously moving above the overbought threshold of 70.

Although the RSI remains slightly above neutral, its retreat indicates that the momentum supporting Ethereum’s August-to-September recovery is fading.

Ether is still holding marginally above its 20-day exponential moving average at approximately 0.03162 BTC. A strong rebound from this moving average could delay or prevent the bearish breakdown.

A sustained move above the two peaks at 0.03344 BTC would invalidate the double-top scenario and restore a more bullish relative outlook for ETH.

The bearish technical setup emerged as the US Senate failed to advance the Digital Asset Market Clarity Act on September 15.

The procedural vote received 50 votes in favor and 49 against but fell short of the 60 votes required to move the legislation forward. A procedural vote change by Senator Thom Tillis preserves the possibility of reconsidering the measure.

The setback triggered a wider cryptocurrency sell-off. Bitcoin declined approximately 4% to around $75,900, while shares of major crypto companies, including Coinbase and Circle, also fell.

Regulatory uncertainty can encourage traders to favor Bitcoin over more risk-sensitive assets such as Ethereum. This could increase pressure on the ETH/BTC pair and bring the 0.03078 BTC neckline back into focus.

Binance receives 709,400 ETH in one day

Ethereum deposits to Binance have also increased sharply, creating another potential source of selling pressure.

Approximately 709,400 ETH moved onto the exchange on September 11, marking the highest daily inflow since June, according to CryptoQuant. Several recent sessions also recorded inflows exceeding 500,000 ETH, considerably above typical July and August levels.

Rising exchange inflows increase the amount of ETH immediately available for trading. Although transfers to exchanges do not necessarily mean holders intend to sell, unusually large deposits can precede higher market supply and increased volatility.

The elevated inflows reinforce the cautious outlook created by Ethereum’s weakening relative momentum and the CLARITY Act setback.

ETH/BTC bulls must defend 0.03078

The bearish scenario depends on ETH/BTC closing decisively below the 0.03078 BTC neckline. Confirmation could open the path toward the measured target of 0.0283 BTC.

However, support from the 20-day EMA near 0.03162 BTC could allow Ether to rebound. A break above 0.03344 BTC would invalidate the double top and signal renewed Ethereum strength against Bitcoin.

U.S. spot bitcoin ETFs shed $450 million on Tuesday, according to SoSoValue, the heaviest single-day outflow since June 25, after the U.S. Senate declined to advance the Digital Asset Market Clarity Act.

Bitcoin is little changed since midnight UTC, after dropping following the vote, which garnered around 10 fewer votes than the 60 required. Among those opposing the motion were seven Democrats who had spent months negotiating the text.

The CoinDesk 20 Index also held its loss, dropping less than 0.1% since midnight after falling 4.6% on Tuesday in the steepest decline since June 5.

Attention now switches to the Federal Reserve, which announces its interest-rate decision later today, with an increase having been the market’s base case going into the meeting.

Stellar fell 9.6% over 24 hours and XRP lost 8.1% Among CoinDesk 100 constituents, a full 95 lost value over the period.

We have watched the alternative play out before. When regulators told websites to obtain consent, they specified the goal and not the method, and the market answered with the cookie banner, the pop-up you dismiss a hundred times a week without reading. Crypto built its own version: upload your ID to everyone. A passport copy in a hundred databases, protecting almost no one and enriching whoever breaches the weakest of them.

And this is only the rehearsal. The internet is being rebuilt around software that acts on our behalf, and the familiar sorting of traffic into “bot” or “human” is already breaking down. A third category is emerging: verified agents transacting, with permission, for real people. Those agents will move money, and they will have to prove they are authorized and what they are allowed to do, at machine speed and machine volume. If they inherit today’s model and drag their owner’s full identity through every service they touch, we will not have a handful of honeypots. We will have billions of them, refreshed continuously, that never sleep.

The $320 million will most likely come back. The addresses, the IDs, and the faces will not. The lesson of these weeks is not that we need higher walls around the data we hoard. It is that we are hoarding data we never needed to collect. The technology to prove without surrendering already exists: provable, private, and portable, for people today and for their agents tomorrow. The only question is whether we adopt it before the honeypot becomes the permanent architecture of both.

Security researchers have traced more than 1,500 KREMLIN malware infections after uncovering a Brazilian banking campaign that uses Ethereum smart contracts to update attack infrastructure and malicious browser extensions to steal credentials and session data.

Elastic Security Labs disclosed the operation in a Sept. 14 technical report after tracking the activity under REF9334 since May 2025. Researchers followed seven campaigns over roughly 15 months and linked the latest versions to Chrome and Microsoft Edge extensions capable of collecting browser credentials, cookies, session tokens and other sensitive information.

SlowMist issued a threat-intelligence alert on Sept. 16 drawing attention to the blockchain component of the operation, including three Ethereum contracts linked to changing command-and-control infrastructure.

Despite the name KREMLIN, Elastic said it found no evidence connecting the campaign to Russia. The toolkit name comes from the malware author’s handle, while the lures impersonate Brazilian banks, use Portuguese-language text and overwhelmingly reach systems located in Brazil.

KREMLIN uses Ethereum contracts as changing address books

Ethereum entered the operation in May 2026, when researchers observed the first malicious smart contract tied to KREMLIN’s infrastructure.

Elastic traced the first contract to May 19. It stored configuration values pointing infected systems toward locations used for the installer and malicious browser extension. Later contracts changed the structure and eventually moved to a key-value configuration model that could be updated by the operator.

The current contract identified by Elastic is 0xCD7360A83E5cdbBbbbcEB0e78748babA6740d07b. Researchers said it remained in use when their report was published. Earlier contracts included 0x902EDbFECFF38f285Bf26283fB9cEB3700061873 and 0x64Def0A6099c4DE9C413B108EAae85A3C7457615.

The contracts do not represent an exploit of Ethereum’s consensus system or smart-contract platform. Elastic found that the attackers used the blockchain as a dead-drop resolver: infected machines read configuration values from the contracts to locate external infrastructure controlled or abused by the operators.

Such a design lets operators change infrastructure references by updating on-chain values while leaving the initial malware unchanged. Elastic recorded contract updates pointing toward different domains and hosted files, including a main-v2 configuration change on Aug. 13.

Crypto.news reported in 2025 that malicious npm packages were using Ethereum smart contracts to retrieve command infrastructure. ReversingLabs researchers described a comparable model in which blockchain data contained locations used to reach attacker-controlled servers.

Microsoft found ClickFix campaigns using BNB Chain smart contracts to retrieve malware instructions. Microsoft’s findings involved a separate campaign but showed another example of public blockchains being used as infrastructure for malware configuration.

Malicious extensions can enter Chrome and Edge without approval

KREMLIN’s browser component uses a technique that lets an unauthorized extension appear properly registered inside Chromium-based browsers.

Elastic said the installer modifies Chrome or Edge’s Secure Preferences data and regenerates the HMACs and encrypted integrity hashes the browser expects. Once those values match, the malicious extension can load even though the user never approved an installation through the official extension store.

The technique itself predates the KREMLIN campaign. Security firm Synacktiv documented the approach in 2025 under research titled The Phantom Extension, showing how an attacker with access to a Windows system could alter Chromium preference records and load an extension through internal browser mechanisms.

KREMLIN operationalized that technique for financial theft. Elastic’s analyzed extension masqueraded as software called AVSync and requested access to tabs, cookies, browser storage and web requests. It could collect saved browser data and intercept information during active web sessions.

The malware gathers browser databases containing login information, cookies and stored form data. Elastic found that it acquired encryption material needed to access protected browser data before sending collected information to attacker-controlled infrastructure.

Initial infection still requires execution of a malicious file. Elastic said the campaign distributes JavaScript files disguised as bank receipts, invoices or corporate documents. Once a victim executes the lure, the loader checks the environment before progressing through later stages.

Brazilian financial brands impersonated in campaign material included Banco do Brasil, Caixa, Bradesco, Sicoob, C6 Bank, Inter, BTG, Safra, PagBank, PicPay, Santander and Mercado Pago.

Elastic counted 1,515 infected hosts after disrupting a kill switch

Elastic gained an unusually direct measure of the campaign’s reach after researchers noticed that KREMLIN checked an unregistered internet domain as part of its anti-analysis process.

The malware was designed to test whether the domain responded. A successful response caused the program to assume it was operating inside an analysis sandbox and terminate itself. Elastic registered the previously unused domain and pointed it to infrastructure the researchers controlled.

Infected machines then began contacting the newly registered address. Elastic counted 1,515 systems at the time of publication, with 98.75% geolocated in Brazil. Researchers said the number was rising quickly.

Registering the domain turned KREMLIN’s own anti-analysis check against the campaign. Machines reaching the domain interpreted the response as evidence of a sandbox and stopped progressing through the infection chain.

Elastic cautioned that the intervention was temporary. “This has temporarily degraded and manipulated the campaign’s defense mechanisms,” the researchers wrote, saying the interruption could give defenders more time to locate and clean affected endpoints.

The systems remained infected, meaning the registration did not automatically remove KREMLIN from compromised computers. Elastic’s report said the affected machines had been prevented from moving beyond the relevant infection stage while the canary remained effective.

The geographic data supports the researchers’ earlier assessment that Brazil is the campaign’s primary target. Portuguese-language filenames, fake error messages and Brazilian financial brands appeared repeatedly across the recovered samples.

Ethereum wallet activity links multiple KREMLIN campaigns

On-chain analysis helped Elastic connect different stages of the malware operation. Researchers identified a single Ethereum wallet used to deploy malicious contracts and update their configurations. The address was financially active before the first KREMLIN-linked contract appeared, giving investigators a transaction trail spanning more than a year.

Between June 19, 2025, and Aug. 24, 2026, Elastic identified 82 USDT transfers associated with the wallet. The recorded activity totaled approximately 20,778.97 USDT received and 19,016.96 USDT sent. Researchers said individual transfers could not be conclusively classified as malware-development funding.

Transaction timing provided another attribution clue. Elastic found that much of the wallet activity lined up with working hours in the UTC-3 time zone used by São Paulo, although the researchers presented Brazil as a plausible operator location instead of a confirmed attribution.

The campaign has changed tooling during its lifespan. Earlier waves distributed PULSAR RAT, while the newer Ethereum-linked branch introduced REMCOS RAT alongside the custom browser extension. Elastic identified two related chains during this period, including one that uses a legitimate signed SentinelOne executable as part of the loading process.

Security teams can use the indicators published by Elastic Security Labs and its accompanying public IOC repository to check endpoint, browser and network telemetry for artifacts tied to the campaign. Elastic mapped the activity to MITRE ATT&CK techniques covering execution, persistence, credential access, browser extensions, command-and-control and data exfiltration.

Brazilian crypto users were targeted by separate WhatsApp-distributed malware in late 2025. That campaign targeted banking, fintech and cryptocurrency credentials but was not linked to REF9334.

Elastic’s latest published blockchain timeline shows KREMLIN’s contract configuration being modified through August, while its infrastructure observations extend into late August 2026. The researchers said the 0xCD7360…d07b Ethereum contract remained in use when the Sept. 14 report was prepared.

Bitcoin traders aren’t exactly panicking about Wednesday’s expected Federal Reserve rate hike, but they aren’t taking many chances either.

Markets are pricing a 92.5% chance the Fed raises rates for the first time in three years after strong employment data and stubborn inflation. Bitcoin has spent the past 24 days stuck between roughly $76,000 and $80,000, with volatility falling to a one-month low.

For some traders, the quarter-point hike is already old news.

“The bond market has done its job and fully priced in tomorrow’s hike,” said Chris Sullivan of Hyperion Decimus. In his view, the bigger shock could come if the Fed doesn’t hike, since that could leave investors wondering what policymakers see that markets don’t.

Appetite for the two largest cryptocurrencies has moved in the other direction. Bitcoin buying conviction has dropped to 3% from 10%, while ether has fallen to 9% from 23%.