A revised version of the CLARITY Act would direct United States regulators to determine whether people or groups controlling “non-decentralized finance trading protocols” must comply with securities, commodities and anti-money laundering (AML) requirements.

The revised text, posted on Senator Cynthia Lummis’ website, defines such a protocol as one whose functionality, operation, or rules can be materially altered by a person or coordinated group. The definition also covers protocols whose controllers can restrict users or whose transactions are not governed solely by transparent, pre-established code.

Under the proposal, the Securities and Exchange Commission (SEC) and Commodity Futures Trading Commission (CFTC) would develop activity-based rules addressing registration, conduct, disclosure, recordkeeping and supervision. Meanwhile, the Treasury would establish how existing Bank Secrecy Act obligations apply to affected controllers.

The bill specifies that software and distributed ledger systems would not be required to register in their own capacity. It also says participation in an incident-response or security council would not, by itself, establish control over a protocol. 

The revised text arrived ahead of a procedural Senate vote scheduled for Sept. 15. The measure requires 60 votes to advance, meaning Republicans will need support from Democrats despite continuing disagreements over ethics, anti-money laundering protections and stablecoin rewards.

Crypto industry backs bill as ethics dispute lingers

In a statement shared with Cointelegraph, Crypto Council for Innovation CEO Ji Hun Kim called Tuesday’s vote a “pivotal moment” for digital assets, innovation and American leadership. Kim told Cointelegraph that the US needs a framework combining consumer protections with business conduct standards.

On Thursday, Coinbase CEO Brian Armstrong told CNBC that the CLARITY Act was “ready to get a yes vote.” He said the “must-have issues” previously raised by Coinbase had been resolved, while negotiations over ethics restrictions remained active and appeared close to a solution. Armstrong did not specify which provisions had changed.

Related: Following Senate delay, crypto bill has narrow window to become law

Despite this, the ethics section in the newly released text remained largely unchanged from the previous version, despite being one of the main points of contention in negotiations. 

On Aug. 20, Democratic Senator Ruben Gallego warned against holding a vote before lawmakers resolved disputes involving ethics and stablecoin yield. “A fast vote gets you a fast result, but I’m not sure it’s the result you want,” Gallego said at the time.

Armstrong said that if the legislation does not advance, the SEC and CFTC could instead pursue rulemaking and innovation exemptions using their existing authority.

Magazine: 10 of the greatest unsolved crypto mysteries

An authorization flaw in Brevo’s login system has allowed an attacker to access 138 customer accounts, leading to phishing emails sent through accounts used by Trezor, BitBox and CoinTracking.

Brevo said in a Thursday postmortem that the attacker exploited a weakness involving its single sign-on system, gaining access to organizations connected to legitimate users who had been invited into an attacker-controlled Brevo account.

The incident affected 138 customer accounts in total. Six were used to send phishing emails, contacts were exported from 43 accounts, while Brevo recorded no meaningful activity across another 93. The company did not specify whether those groups overlapped.

Brevo flaw gave attacker access to customer organizations

Brevo traced the incident to the way its platform handled permissions when users belonged to more than one organization.

The attacker first created a Brevo account and enabled single sign-on before inviting legitimate Brevo users into the newly created organization. Access should have remained limited to the attacker-controlled organization.

Instead, Brevo said an authorization boundary failed, allowing the attacker to reach every organization that the invited users themselves had permission to access.

The compromised accounts included those used by hardware wallet makers Trezor and BitBox and crypto portfolio tracking and tax-reporting service CoinTracking. Access to the legitimate email infrastructure allowed fraudulent messages to be distributed in a way that made them look like normal company communications.

The disclosure provides the technical explanation behind the phishing emails targeting Trezor and BitBox customers this week. Crypto.news previously reported that both hardware wallet companies warned users on Wednesday after identifying fraudulent security messages distributed through a third-party newsletter provider.

Because the messages were sent through legitimate mailing infrastructure, they could pass normal email authentication checks and reach subscribers from addresses associated with the affected companies.

Trezor’s phishing email used the subject line “Critical Security Alert: STM32 Entropy Vulnerability” and presented a supposed hardware security problem that required users to take action.

The message directed recipients to a malicious application that requested their wallet backups. Anyone who obtains a wallet recovery phrase can recreate the corresponding wallet and gain control over its funds.

Trezor phishing email reached 347,000 subscribers

Trezor said its Brevo account contained roughly 347,000 opt-in newsletter email addresses, with no other customer information stored on the platform.

A Trezor spokesperson told Cointelegraph that the initial phishing message was sent to all 347,000 addresses. The company subsequently contacted the same subscribers to warn them about the attack.

Trezor took the malicious domain offline at the DNS level within 20 minutes. Around 2,500 people had accessed the link before the takedown, according to the company.

“Until we hear more from Brevo, we are treating all roughly 347,000 newsletter addresses as known to the attacker and possibly reusable for phishing,” the spokesperson said.

Trezor said the Brevo incident did not compromise its hardware wallets, wallet backups or other internal systems. Customers who did not enter their wallet backup into the malicious application remained safe, according to the company.

The campaign follows several other phishing attempts involving the hardware wallet maker. In August, a Trezor user said he lost his life savings after a sponsored Google search result directed him to a fake website hosted through Google Sites.

Trezor said at the time that it was seeing more phishing websites impersonating the company through sponsored search results and warned customers never to enter wallet backups on websites.

Earlier in 2026, scammers took the impersonation attempts offline by sending fake Trezor and Ledger letters to hardware wallet owners. The letters contained QR codes leading to phishing websites that requested 12, 20 or 24-word recovery phrases under the pretext of completing authentication or transaction checks.

BitBox and CoinTracking accounts used in phishing wave

BitBox identified a similar campaign on Wednesday and warned users not to follow instructions contained in fraudulent emails sent under its name.

Its initial investigation found that several Bitcoin companies had been targeted and appeared to share the same newsletter provider. BitBox contacted the provider, warned newsletter subscribers and reported the phishing domains while investigating how the emails had been distributed.

The attack came weeks after BitBox patched two wallet vulnerabilities involving firmware installation and Bitcoin address handling. BitBox said there was no known exploitation of either flaw and reported no stolen user funds.

CoinTracking customers received a different phishing lure designed around the service’s portfolio tracking and tax-reporting functions.

The fraudulent email carried the subject line “Data Breach Notice: Please refresh API Keys as soon as possible,” according to CoinTracking. The company warned customers not to follow links contained in the message while it investigated the compromise of its Brevo account.

Brevo’s findings show that phishing emails represented only part of the activity across the 138 accessed accounts. The attacker exported contacts from 43 accounts, potentially leaving address lists available for use outside Brevo’s own mailing infrastructure.

Trezor is already treating its full newsletter list as potentially known to the attacker, although the company said it had not received confirmation that all 347,000 addresses were exported.

The hardware wallet maker has faced a separate customer data exposure this year involving logistics provider ShipMonk. Trezor initially disclosed in August that information belonging to 13,689 customers had been exposed through the shipping provider.

The scope later increased after Trezor learned that records belonging to approximately 67,000 additional U.S. customers had remained in ShipMonk’s systems. The older records covered purchases made between November 2019 and August 2021 and included names, email addresses, phone numbers, shipping addresses and order numbers.

Trezor said its own systems were not compromised in the ShipMonk incident and no private keys or recovery phrases were exposed. The company had previously received assurances that the older customer records had been deleted before learning on Sept. 2 that they remained stored by the provider.

Nu has launched U.S. deposit accounts, credit cards and international transfers through Lead Bank while introducing a stablecoin-based account serving more than 35 countries.

Nu said on Sept. 10 that customers could register immediately for early access to the products. The NYSE-listed financial technology company is entering the U.S. through a partner-bank structure because its own national bank charter remains subject to further regulatory approvals.

The U.S. offering includes an account paying a variable 3.50% annual percentage yield, a debit card and a Mastercard credit card carrying no annual fee. Nu Global, a separate international product, converts customer deposits into USDC or EURC and supports transfers across parts of Europe and Latin America.

Nu enters U.S. banking through Lead Bank

Nu is not currently a bank in the United States. Banking services and the Nu Credit Card are provided by Lead Bank, a member of the Federal Deposit Insurance Corporation, according to disclosures accompanying the launch.

Customer deposits in the Nu Account are held at Lead Bank. Nu says the account pays 3.50% APY on every available dollar, with interest calculated and credited daily. The advertised rate was accurate as of Sept. 10 and may change after an account opens.

Users receive access to savings goals without losing immediate access to their funds. The account supports domestic transfers and international transfers beginning with Brazil, Mexico and Colombia, although Nu says more destinations will follow.

A limited-edition metal debit card forms part of the initial package. Through its Mastercard relationship, Nu is offering a metal World Elite credit card with no annual fee and unlimited 1.5% cashback on purchases.

The company plans to raise the cashback rate to 2% for customers who meet qualifying conditions. Nu has not disclosed the complete eligibility terms or confirmed when the higher rate will become available.

Eligible customers will eventually be able to earn 4.50% APY on savings balances of up to $10,000. To qualify, a customer must hold the Nu Account and credit card, then complete at least three eligible card transactions within the previous 34 days. Balances above $10,000 will continue earning the standard rate, according to the product disclosure.

Nu Global holds balances in USDC and EURC

Nu Global gives customers a digital account for holding, transferring and spending funds across more than 35 countries. Every deposit is converted into either USDC, a dollar-pegged stablecoin, or EURC, a euro-pegged stablecoin.

The company advertises a variable daily yield equivalent to 3.50% APY for USDC balances and 2.20% for EURC. Nu’s announcement does not identify how the yield is generated, which legal entity holds the stablecoins or whether the balances receive deposit insurance.

Stablecoins are digital assets designed to track reference currencies, but they are not the same as insured bank deposits. Nu Global should therefore be distinguished from the U.S. Nu Account provided through Lead Bank.

Customers receive a virtual Mastercard for spending their balances. Nu says the card offers competitive foreign exchange rates without markups, while transfers between supported countries carry no service fee.

The first group of supported markets covers much of the European Union and several Latin American countries. Transfers are available in Argentina, Chile, Costa Rica, El Salvador, Honduras, Paraguay, Peru and Uruguay, according to a market list reported by Folha de S.Paulo.

European coverage includes Germany, France, Italy, Spain, Portugal, Ireland, Switzerland, Sweden and more than 20 other jurisdictions. Integrations involving Nu’s businesses in Brazil, Mexico, Colombia and the U.S. are planned for the coming months.

The product permits customers to hold and trade selected digital assets, including Bitcoin and Ethereum. Nu has not published a complete token list, custody arrangement or fee schedule for those trades in its launch announcement.

In related coverage, 21 financial institutions are preparing a multicurrency stablecoin venture expected to begin issuing tokens in 2027. Separately, U.S. Bank completed a cross-border stablecoin pilot between its North American and European entities using Stellar.

Nu’s U.S. bank charter is not final

Nu applied to form Nubank, N.A. in September 2025. The Office of the Comptroller of the Currency granted conditional approval on Jan. 29, allowing the company to enter the bank-organization phase.

Conditional approval does not authorize Nubank, N.A. to begin independent banking operations. Nu must satisfy the OCC’s conditions and secure required approvals from the Federal Reserve and FDIC.

The company said in January that it needed to capitalize the proposed institution within 12 months and open the bank within 18 months. U.S. chief executive Cristina Junqueira told Reuters that she expects the bank to begin operating in 2027.

A completed charter would allow Nubank, N.A. to offer deposit accounts, credit cards, lending and digital asset custody under a federal banking structure. Until then, Nu’s U.S. customers receive regulated banking products from Lead Bank.

Nu founder and chief executive David Vélez described the launch as the beginning of a “multi-decade journey” outside Latin America. His statement presents the company’s strategy and should not be read as a forecast of future market share.

Junqueira said capturing even a small portion of the U.S. market “will be transformative for our business.” Nu has not published U.S. customer, deposit or revenue targets for the new operation.

U.S. launch follows Nu’s first $1 billion quarter

Nu reported $1.06 billion in net income for the second quarter of 2026, crossing $1 billion for the first time. The result increased 49% from the previous year on a currency-neutral basis and exceeded the $967.2 million Visible Alpha estimate cited by Reuters.

Second-quarter revenue reached $5.88 billion, up 39% and above the cited $5.60 billion forecast. Its risk-adjusted net interest margin rose to 12.4% from 9.9% one year earlier.

The company serves more than 140 million customers across Brazil, Mexico and Colombia, according to its latest announcement. Brazil remains its largest operation, where Nu says it serves more than 60% of the adult population.

In Mexico, the company describes itself as the largest digital bank. Nu says its Colombian business ranks fourth among the country’s financial institutions by deposits, though the claim depends on the company’s selected market classification.

Nu shares gained as much as 1.6% during U.S. trading after the announcement, Reuters reported. The publication identified the move as the market’s initial reaction, not a measure of the U.S. operation’s future financial performance.

Nu Global is already available in selected European and Latin American markets. The company has not provided exact launch dates for its planned integrations with Brazil, Colombia, Mexico and the United States.

Senate Republicans have released a revised 630-page Clarity Act that adds federal oversight for certain crypto trading protocols five days before a scheduled Sept. 15 procedural vote.

Sen. Cynthia Lummis said on Sept. 10 that Republicans had incorporated more than 114 provisions requested by Democratic senators during negotiations. The Wyoming Republican described the new version as a bipartisan product, although no Democratic senator had publicly endorsed the revised text when it was released.

The Senate vote will determine whether lawmakers can begin formal debate on the crypto market structure bill. It is not a final vote on passage. Republicans need enough Democratic support to reach the Senate’s 60-vote procedural threshold because they control 53 seats.

Clarity Act revision targets controlled trading protocols

New language in the Clarity Act establishes a category called a “non-decentralized finance trading protocol.” The draft applies the term to people or coordinated groups that possess direct or indirect authority to control or materially change a protocol’s functions, operations or consensus rules.

Protocols covered by the definition would need to register with the Commodity Futures Trading Commission. The bill directs the CFTC and the Treasury Department to develop implementing rules, leaving the agencies to determine how the standard would work across different technical and governance arrangements.

The provision seeks to separate systems operating without a controlling party from platforms marketed as decentralized while retaining identifiable management or upgrade authority. 

Questions about control have remained central to the Senate debate over DeFi regulation. Lawmakers have disagreed over whether software developers, interface operators and governance participants should face financial compliance duties when they do not take custody of customer assets.

The latest text limits its DeFi provisions to spot and cash digital commodity transactions. Lummis said the clarification responds to concerns from tribal governments about whether the legislation could affect prediction markets, which may involve separate federal and state legal questions.

Credit unions received further clarification on permissible digital asset activity, according to her statement. Public summaries available Thursday did not identify every provision changed in the full draft.

Ethics language remains a barrier to Democratic votes

The revised Clarity Act retains an ethics provision restricting public officials, government employees and their spouses from issuing or sponsoring digital assets. Enforcement authority would remain primarily with the Justice Department, while the restriction would expire in January 2029.

President Donald Trump accepted the provision in July, but Democratic lawmakers called it inadequate. Their objections have centered on the scope of the covered activity, the limited enforcement mechanism and the provision’s expiration date.

Trump and members of his family have financial connections to World Liberty Financial and the TRUMP memecoin. Critics say legislation regulating crypto markets should contain stronger restrictions governing digital asset interests held by senior federal officials.

A separate ethics proposal developed by Democratic senators and Republican Sen. Thom Tillis sought stronger terms. The Sept. 10 revision did not adopt major elements of that alternative, according to a report from Politico.

No Democratic support had been secured for the latest version at publication time, Politico reported. The lack of public commitments leaves Republicans short of the votes required to open debate if the chamber divides along party lines.

Lummis said the bill would give the digital asset industry a durable statutory structure that could not be changed as easily as agency rules following a new presidential administration. Her statement represents the sponsors’ position on the legislation’s value and permanence.

Stablecoin rewards and bank deposits remain disputed

Banking groups and crypto companies continue to disagree over stablecoin rewards. Banks contend that rewards paid on stablecoin balances could encourage customers to move money from insured accounts, reducing deposits used to support lending.

Crypto companies argue that transaction-based incentives differ from interest paid on bank deposits. Earlier Senate language prohibited payments based solely on holding a stablecoin while permitting rewards connected with payments, loyalty programs and other qualifying activity.

The disagreement has generated lobbying campaigns in senators’ home states. Reuters reported that the Independent Community Bankers of America had arranged meetings between local bankers and senators during the August recess.

Stand With Crypto, an advocacy organization backed by Coinbase, said its supporters contacted members of Congress nearly 50,000 times during August. The group reported holding events and publishing opinion pieces across several states to support passage.

Some Republicans have raised concerns alongside Democratic critics. Sens. James Lankford and Mike Rounds have questioned whether the bill could allow certain digital tokens to compete with traditional deposits, Reuters reported.

Democrats have cited separate concerns involving money laundering controls, consumer protection and market integrity. The revised protocol language addresses one part of the illicit-finance debate, but its release did not produce an announced agreement on the remaining disputes.

The Sept. 15 vote only opens floor debate

Senate Majority Leader John Thune scheduled the procedural vote for Sept. 15, one day after senators return to Washington. The scheduled vote requires 60 senators to support moving the Clarity Act into floor consideration.

A successful vote would permit debate and open the bill to amendments. Senators could seek changes to the ethics provision, stablecoin reward rules, DeFi requirements or the allocation of authority between the Securities and Exchange Commission and CFTC.

The legislation would create federal classifications for digital assets and divide oversight between the two market regulators. The CFTC would receive authority over spot markets for assets classified as digital commodities, while the SEC would retain jurisdiction over securities.

House lawmakers previously passed their version of the Clarity Act with support from members of both parties. Any changes adopted by the Senate would require the two chambers to approve identical text before the legislation could reach Trump.

Time remains limited because lawmakers are preparing for the November midterm elections. Reuters reported that crypto companies view the remaining 2026 legislative calendar as a critical opportunity, while analysts described the bill’s prospects as uncertain because of opposition from Democrats and several Republicans.

Lummis, who is not seeking another Senate term and will leave Congress in January 2027, has continued pressing lawmakers to approve the measure. In a Sept. 9 statement, she argued that the United States should set its own crypto rules instead of allowing jurisdictions such as Singapore or the United Arab Emirates to take the lead.

If the motion receives at least 60 votes, Senate leaders can proceed to debate and schedule amendment votes. Fewer than 60 votes would prevent the chamber from moving to the current bill unless leaders negotiate new terms and schedule another procedural attempt.