The CFTC has granted conditional broker-registration relief to passive software providers under a no-action position that sets 10 requirements for developers offering tools connected to regulated derivatives trading.

CFTC relief covers passive derivatives software

The CFTC’s Market Participants Division said in a Sep. 17 release that it had issued a no-action position for providers of passive software used to facilitate derivatives trading.

Under the position, division staff will not recommend that the Commission take enforcement action against a qualifying provider or its relevant personnel for failing to register as an introducing broker or an associated person of an introducing broker. The protection applies only to activities covered by the letter and remains subject to its stated conditions.

Software providers can qualify when their products allow users to trade with registered futures commission merchants, introducing brokers and designated contract markets. Users must remain customers or direct members of the regulated entity handling their transactions rather than becoming customers of the software provider.

Although the headline refers to crypto developers, the CFTC’s language covers passive software providers involved in regulated derivatives markets. Crypto wallet developers and other digital-asset software companies may fall within the framework when their tools connect users to eligible derivatives products, but the position does not provide blanket protection for every developer or crypto application.

Staff Letter 26-25 makes the position available to qualifying providers after the agency gave similar treatment under Staff Letter 26-09. The earlier letter addressed a request involving software that gave users access to regulated derivatives while leaving trade execution, customer accounts, and asset control with registered firms.

The new position is not a formal exemption from the Commodity Exchange Act. According to the CFTC’s description of its staff-letter process, a no-action letter means the issuing division will not recommend enforcement for failure to comply with a specified legal provision. It does not change the law or bind other divisions in the same manner as a Commission rule.

Ten conditions limit the registration relief

Among the 10 conditions, a provider and the personnel engaged in covered activities cannot be subject to statutory disqualification. Such disqualifications can include certain convictions, regulatory orders, or other legal findings that prevent a person from taking part in registered derivatives businesses.

Customers using the software must have a direct relationship with the registered exchange or intermediary serving them. They must also be able to access the registrant without using the provider’s software, which prevents the developer from becoming the customer’s only route to the regulated firm.

The provider cannot publish advertising or promotional material that would require advance approval from the National Futures Association if the business were registered as an introducing broker. While developers can market their software within the letter’s limits, the condition restricts conduct resembling regulated brokerage promotion.

To use the position, a provider must file a notice with the Market Participants Division and agree to satisfy every condition. The filing must also include consent to the CFTC’s jurisdiction to investigate the provider and pursue enforcement over violations connected to its covered activities.

Relief will remain in place until the effective date of any Commission rule or guidance dealing with how introducing-broker requirements apply to the covered software activity. A future rulemaking could therefore replace the staff position with a permanent framework or impose a different registration test.

The registration question matters because introducing brokers normally solicit or accept orders involving futures, commodity options, swaps, or certain retail commodity transactions without holding customer funds. Passive software can perform parts of that process through code even when its developer never controls assets or executes the transaction itself.

As previously explained by crypto.news in its review of the CFTC registration structure, introducing brokers sit alongside futures commission merchants, designated contract markets, clearing organizations and other regulated participants in the U.S. derivatives system. Each category carries separate registration, conduct and compliance duties.

CFTC action gives U.S. developers a defined route

For developers serving U.S. customers, the position provides a way to offer qualifying tools without immediately taking on the full duties attached to introducing-broker registration. Access remains tied to CFTC-regulated businesses, while developers must stay inside the limits covering customer relationships, marketing and regulatory oversight.

American users do not receive permission to trade products that would otherwise be unavailable to them. The letter concerns the registration status of the software provider, not whether a particular derivative, exchange or customer transaction complies with U.S. law.

The CFTC also retains its enforcement powers outside the narrow registration issue covered by the letter. Fraud, manipulation, unlawful solicitation and breaches of the conditions can still trigger regulatory action, while registered exchanges and intermediaries remain responsible for their own duties under the Commodity Exchange Act.

Regulated crypto derivatives already sit inside the agency’s jurisdiction. Futures, options, and swaps tied to digital commodities must trade through the applicable U.S. regulatory structure, and the CFTC has previously brought cases against offshore platforms accused of offering leveraged crypto products to American customers without registration.

For passive wallet and interface providers, control over customer property and trade decisions can be central to whether their conduct remains within the letter. A developer taking custody, recommending trades, generating explicit buy or sell signals, or acting as the customer-facing intermediary could present facts outside the passive model addressed by the CFTC.

SEC and CFTC use existing powers after CLARITY setback

The CFTC announcement arrived on the same day that the Securities and Exchange Commission issued a separate five-year trading exemption for eligible venues offering tokenized National Market System stocks.

Under the SEC order, approved venues may use permissioned automated market makers and liquidity pools for tokenized stock trading. Covered tokens must provide the same rights and privileges as the traditional shares they represent, while synthetic products that merely track a stock’s price do not qualify.

Eligible venues face limits on supported stock symbols and trading activity. Smart contracts must be public and auditable, and trading in a tokenized share must stop when the primary exchange halts the underlying stock. The SEC also requested public comments as it considers possible changes to the framework.

Both agency actions have followed the Senate’s failure to advance the Digital Asset Market CLARITY Act. Senators rejected cloture on Sep. 15 by 50–49, leaving the motion 10 votes short of the 60 required to begin debate.

The bill sought to divide digital-asset oversight between the SEC and CFTC while establishing registration routes for exchanges and other intermediaries. Seven Senate Democrats who opposed cloture have since reopened negotiations, although no second procedural vote has been scheduled.

Separate from the market-structure bill, the House Ways and Means Committee advanced the Digital Asset Tax Certainty Act in a 38–5 vote on Sep. 16. The proposal addresses staking rewards, digital-asset lending, wash-sale rules, dealer treatment and a proposed exemption for certain network and transaction fees of up to $10.

Without art fairs, today’s highly globalized and commercialized art world would not exist. While many galleries complain about the high cost and grueling travel required to participate in international trade shows, they also rely on them to expand their clientele and turn buying art into an event. As chief executive of Art Basel, the most famous brand in art fairs, Noah Horowitz understands this paradox well. Since he took on the role in 2022, he has doubled down on Art Basel’s core business, most visibly by allying with the Qatari royal family to launch the firm’s fifth annual fair in Doha this past February and shepherding its Paris show to the historic Grand Palais in 2024. But he has also expanded the brand’s reach in forward-looking ways, including by augmenting its fairs with the dedicated digital art section Zero 10 and a retail shop for branded and artist-created merchandise, as well as diversifying Art Basel’s partnerships lineup with big names like Miu Miu, Samsung, and Qatar Airways. “I felt there was more Art Basel could do proactively and creatively… to meet an evolving market where it was,” Horowitz says. Now, he and his team are “working double time” to get there. 

US authorities on Thursday announced sanctions against Iranian crypto exchange BitBank, accusing it of processing Bitcoin paid by ships transiting the Strait of Hormuz.

The US Department of the Treasury’s Office of Foreign Assets Control said that as of June, the Hormuz Safe Marine Services Authority used BitBank to transfer payments it received to the Islamic Revolutionary Guard Corps. The Treasury alleged it is part of the architecture used by Iranian financier Babak Zanjani to move hundreds of millions of dollars in Bitcoin to the IRGC.

Treasury has previously alleged Hormuz Safe is part of an IRGC-backed scheme forcing vessels to buy maritime insurance for passage, including coverage against seizures by Iran itself.

“Today’s designations of Iranian digital asset infrastructure make perfectly clear that efforts to finance the Iranian regime using cryptocurrencies are not beyond OFAC’s reach,” said US Treasury Secretary Scott Bessent. 

The designation is the latest Treasury action aimed at isolating Iran from the international financial system, including through sanctions on digital asset exchanges. 

The OFAC designations include BitBank, its developer Pishtaz Simorgh Electronic Trade Company and three associates of Zanjani, with the Treasury calling them “key components of the Iranian regime’s digital assets-based sanctions evasion infrastructure.”

Cointelegraph reached out to BitBank for comment. 

Iran’s BitBank is a separate entity from bitbank, inc, a fully licensed crypto exchange founded in 2014 in Japan, which was acquired by SBI Holdings in June. Treasury’s designation lists BitBank as having been established in 2024. 

Related: Bitcoin tops $79K, oil falls as Trump says Iran war could end 

In August, the US sanctioned two digital asset exchanges, Shelbit and Aban Tether, accusing them of assisting the Iranian regime in sanctions evasion. Treasury also sanctioned four crypto exchanges, including the country’s largest, Nobitex, in June. 

In July, the US government ordered the freezing of more than $130 million in USDt held in wallets linked to Iran. 

Iran has reportedly sought to mitigate the impact of tightening financial restrictions. Earlier this month, the Financial Times reported that Iran’s central bank eased foreign currency controls to encourage businesses to bring overseas earnings home, including through cryptocurrency, amid tightening US sanctions. 

Magazine: North Korea drives onchain malware surge, CoinEx shuts: Asia Express

Onchain attacks are accelerating fast, with new research from Chainalysis pointing to a sharp rise in malware activity across public blockchains. The firm reports a 420% increase in onchain malware this year and says state-linked hackers—especially groups tied to North Korea and Iran—are responsible for most of the jump.

Chainalysis also argues that public blockchains make malicious campaigns unusually resilient: even if domains, servers, or traditional code hosting are taken down, the data stored on-chain can remain accessible and usable for longer periods.

Key takeaways

• Chainalysis attributes the majority of this year’s 420% surge in onchain malware to state-linked hackers, particularly those linked to North Korea and Iran.
• State-linked activity accounts for about two-thirds of new onchain malware cases involving attackers posting malware instructions or infrastructure details.
• Chainalysis identified UNC5342, a North Korea-linked group, tying it to previously unattributed activity spanning Tron, Aptos, and BNB Smart Chain.
• Public blockchains can extend malware “lifespans” by keeping command-and-control or payload-related instructions available after off-chain infrastructure is removed.

State-linked activity drives the onchain malware spike

Chainalysis’ report centers on how attackers are increasingly using public blockchains not just to move funds, but to store malicious instructions and supporting infrastructure information. According to the firm, the result is a significantly larger volume of malware operations visible on-chain this year—up 420%—with state-linked actors responsible for most of the increase.

The analysis highlights that state-linked hackers represent roughly two-thirds of new onchain malware activity. In practical terms, this suggests that the most sophisticated and persistent malicious campaigns are becoming more integrated with blockchain-based execution and data storage rather than relying solely on conventional, easily disrupted infrastructure.

Chainalysis further points to UNC5342, a North Korea-linked group, connecting it to earlier unattributed activity across multiple ecosystems, including Tron, Aptos, and BNB Smart Chain. For investors and builders, cross-chain attribution matters because it implies reuse of tactics and tooling across networks rather than isolated incidents confined to one platform.

Why public blockchains can make malware harder to eliminate

One of Chainalysis’ most important arguments is that onchain storage changes the operational economics of malware. Unlike typical malware infrastructure—where a takedown can sever access to payload code, hosting, or instructions—information recorded on public ledgers can remain accessible even after external components are removed.

Chainalysis explains that this durability can extend the life of malware campaigns. If attackers store instructions or infrastructure-related data on-chain, defenders may be able to shut down servers or domains, but the underlying on-chain information may still be retrievable and exploitable depending on how the malware is designed.

The report draws a comparison to earlier behavior attributed to North Korean hackers. In 2025, these actors reportedly used a technique referred to as EtherHiding to place crypto-stealing code inside smart contracts—again leveraging the fact that smart contract deployments are difficult to “undo” once they are live.

Attribution across chains signals broader threat tooling

Chainalysis’ identification of UNC5342 across Tron, Aptos, and BNB Smart Chain emphasizes a trend security teams have increasingly observed: attackers are treating chains as interchangeable environments for distribution, execution, or storage of malicious components.

For users, that means the risk of onchain malware is not limited to a single network’s vulnerabilities. For exchanges, custody providers, and wallet developers, it raises the importance of monitoring not only for known malicious contracts or addresses, but also for patterns in how malware instructions are encoded, delivered, and referenced—especially when the “instructions” are stored directly on-chain.

While Chainalysis’ findings show a strong state-linked component, the broader takeaway is that attackers can scale by shifting to platforms where their prior experience or infrastructure can be adapted with minimal changes.

What to watch next in onchain defense

As Chainalysis reports more state-linked actors adopting onchain methods, the immediate focus for the market should be on faster detection of onchain malware patterns and more robust controls around smart contract interactions, data indexing, and monitoring of malicious instructions stored on-ledger.

Readers should watch for whether this 420% rise continues into subsequent reporting periods, and whether security firms further narrow attribution to specific groups and techniques—particularly those that allow malware logic to remain usable even after off-chain elements are disrupted.

AI-linked crypto tokens have added about 9.4% in market value over the past 24 hours as King Charles III has hosted executives from Nvidia, OpenAI, Anthropic and Google DeepMind for talks on artificial intelligence safety.

According to CoinGecko data, the artificial intelligence token category held a combined market capitalization of about $18.6 billion on Sep. 17, with 24-hour trading volume reaching $2.42 billion.

The sector’s 9.4% rise outpaced a 1.9% increase in the total cryptocurrency market, which stood at about $2.72 trillion. AI agents gained 6.6%, AI applications rose 6%, and decentralized finance projects using artificial intelligence added 8.1%.

NEAR Protocol led the large-cap names with a 20.8% gain to about $3.05. Artificial Superintelligence Alliance, formerly known by the FET ticker, advanced 11.7% to $0.1674, while Render climbed 10.2% to $1.42. Bittensor rose 6.9% to about $229.48.

NEAR leads the AI crypto token rally

NEAR’s advance followed a milestone involving its confidential transaction infrastructure. As crypto.news reported on Sep. 17, confidential total value locked on the network exceeded $70 million, triggering the first snapshot under its incentive program.

The snapshot set aside 333,333 milestone tokens for eligible users. To qualify, users must hold more than $100 in confidential balances and have an active swap history, while each wallet can receive no more than 2% of the distribution.

NEAR said the tokens would remain locked until the asset’s three-day volume-weighted average price reaches at least $3.33. Its Confidential Intents system supports private execution across more than 30 connected blockchains.

The network has linked Intents to infrastructure for autonomous agents that may need to make payments or move assets across several chains. In July, NEAR also introduced a staking-based payment tool that lets users lock NEAR to receive monthly computing credits for 43 AI models, including services from OpenAI, Anthropic, and Google.

For Bittensor, CoinGecko pointed to OpenRoboto, also known as Subnet 80, going live on Base through a ForeverMoney wrapper. The integration uses Chainlink’s Cross-Chain Interoperability Protocol and gives the subnet access to Coinbase’s Ethereum layer-2 network.

Project-level news also separates the strongest token moves from the royal meeting. The summit did not announce blockchain integrations, token purchases, funding for decentralized AI networks or direct support for any cryptocurrency.

King Charles asks AI companies to agree on safety principles

At Dumfries House in East Ayrshire, Scotland, Buckingham Palace said King Charles brought together technology executives, government officials and civil society representatives to discuss how AI should be developed and used.

The Ditchley Foundation organized the event with the King’s Trust, the King’s Foundation and the Sustainable Markets Initiative. UK artificial intelligence minister Kanishka Narayan also attended.

Delegates considered whether companies and governments could establish common principles for AI systems. Buckingham Palace described the meeting as a discussion about a possible framework but did not announce a signed agreement, binding commitment or regulatory plan.

Speaking before the talks, Charles called for safety to remain central to AI development and warned about the “existential dangers” of the technology reaching the wrong hands.

“The task before you is not merely to advance technology, but to ensure that it remains firmly in the service of humanity.”

Nvidia chief executive Jensen Huang called for “responsible optimism,” according to Reuters, and warned against releasing systems before they are ready. Huang did not support an industry-wide pause, favoring voluntary controls by individual companies instead.

Questions about who can verify automated decisions have also reached the crypto sector. In a recent interview on AI verification, RoboTech Frontier Hub founder Denis “Dan” Saklakov said blockchains could record model states, permissions, decision conditions and execution histories without placing the AI system itself onchain.

Saklakov also argued that systems making financial decisions should separate analysis from authority. His firm’s Meijin tool uses AI to monitor investments but relies on deterministic, auditable rules when managing exits, rather than letting a language model make an unrestricted decision to move funds.

Anthropic proposal raises pressure on frontier laboratories

The Scottish meeting followed a call from Anthropic CEO Dario Amodei to reduce the speed at which leading laboratories improve their most capable models. In his September essay, “We Must Pace the Frontier,” Amodei said companies should give outside evaluators continuing access to their development processes.

His three-step proposal covers embedded independent evaluators, coordination among companies in democratic countries and possible agreements between governments. Amodei said the proposal would not stop model training or technical progress but would give safety work more time to catch up with model capabilities.

One concern cited by Amodei was recursive self-improvement, in which AI systems increasingly contribute to the design and training of their successors. He also pointed to the security failure involving OpenAI agents and Hugging Face.

In an August incident report, OpenAI said internal research models bypassed controls meant to isolate them from the internet during cybersecurity evaluations in July. The agents accessed parts of OpenAI’s research infrastructure and systems belonging to Hugging Face.

According to OpenAI, the agents executed code on dozens of Hugging Face servers, obtained root access to one server and accessed limited private data. OpenAI said customer data, product availability and normal services were not affected.

Internal monitoring detected unusual credential activity on July 19, and investigators connected it to the Hugging Face breach the following day. OpenAI said it subsequently imposed tighter alignment requirements, placed new limits on internet access and created more isolated testing environments.

US investors face a split response to AI safety calls

For American investors, the debate has affected listed semiconductor companies more directly than crypto-linked investment products. Nvidia, AMD and Intel shares fell after Amodei published his proposal, with Nvidia dropping as much as 3%, AMD losing about 4% and Intel declining roughly 6%, according to the Los Angeles Times.

OpenAI CEO Sam Altman and xAI founder Elon Musk publicly supported coordinated work to reduce frontier-model risks, while industry leaders differed over whether formal restrictions should apply. OpenAI President Greg Brockman said any coordinated slowdown should focus on companies developing the most capable systems rather than open-source developers and hobbyists.

President Donald Trump rejected the warnings in several Truth Social posts. He called the idea of AI taking control a “hoax,” linked the warnings to the political left, and dismissed predictions that robots would enter cities and eliminate people.

State-linked hackers accounted for roughly two-thirds of new activity each quarter as the number of times attackers stored malware instructions or infrastructure information on public blockchains rose 420% over the past 12 months, according to a Chainalysis report. 

Chainalysis identified North Korea and Iran-linked operators among the state actors adopting the technique. In one of the report’s findings, the analytics firm connected previously unattributed activity spanning Tron, Aptos and BNB Smart Chain (BSC) to UNC5342, a North Korea-linked group tracked by Google Threat Intelligence. 

Encoded pointers in Tron and Aptos transactions directed infected devices to the same BSC transaction, with Tron serving as the first route and Aptos as a fallback, Chainalysis reported. The BSC transaction contained encrypted server addresses and configuration data that connected compromised devices to offchain infrastructure used for remote access and data theft. 

Chainalysis said using public blockchains increases the durability of malware campaigns because the stored information remains accessible after domains, servers or code repositories are taken down. In 2025, North Korean hackers used a similar technique called EtherHiding to place crypto-stealing code in smart contracts.

AI tools accelerate malicious writes

The company also recorded a 440% increase in malicious blockchain writes since July 2025, when it said high-capacity open-source Chinese artificial intelligence models became capable of producing malicious code with limited safeguards.

Eric Jardine, cybercrimes research lead at Chainalysis, told Cointelegraph that they found a “clear point-in-time association,” but could not prove that the actors publishing the malicious transactions and contracts had used the models to increase their output.  

Related: Iran eases currency rules to bypass US sanctions with crypto: Report

Iran-linked actors put malware directions on Bitcoin

Chainalysis also identified threat actors it suspects are linked to Iran’s Ministry of Intelligence writing encoded command-and-control routing data onto the Bitcoin blockchain. 

The company said its assessment was based on the malware family, decoding method, timing and server infrastructure associated with previously reported Iranian operations, rather than the blockchain activity alone.

Attacker-controlled wallets sent small payments to a well-known Bitcoin address with historical ties to Bitcoin creator Satoshi Nakamoto, according to the report. Chainalysis said the address had no connection to the attackers and served as a permanent public location that infected devices could check for updated directions.

The attackers could change their server infrastructure by publishing another Bitcoin transaction, after which infected devices would automatically retrieve the new information. Once the malware obtained those instructions, the operation moved offchain for activities that could include remote access, credential theft and the delivery of additional malware. 

Magazine: Revolut ID thefts highlight KYC’s dangers: Here’s how to fix it