CleanSpark shares have gained 4.73% to close near $13.40 after the Bitcoin miner proposed a $2.227 billion secured notes offering to finance construction at its Sandersville data center campus.

CleanSpark said on Sep. 17 that its wholly owned subsidiary, CSDC Finance I LLC, plans to sell $2.227 billion of senior secured notes through a private placement.

The notes would mature in 2031, with most of the proceeds directed toward completing CleanSpark’s Sandersville data center in Georgia. According to the company, the financing would also reimburse certain equity investments already made in the project and create debt-service reserve accounts.

Rather than issuing the debt directly, CleanSpark has placed the proposed transaction within a subsidiary tied to the Sandersville project. CSRE Properties Sandersville LLC, another wholly owned unit, would guarantee the notes.

CleanSpark said the debt would also receive a first-priority lien on most assets belonging to the issuer and the property company. Under the proposed structure, the Sandersville assets would therefore serve as collateral for the financing.

CleanSpark debt plan avoids announced share conversion

For CleanSpark investors, the structure differs from a convertible bond or new share sale because the announced notes carry no right to be exchanged for CLSK stock. The company’s proposal therefore does not create direct share dilution through conversion under the terms disclosed on Thursday.

Debt financing still places repayment and interest obligations on the borrower, while pledged assets may be available to creditors if the issuer defaults. CleanSpark has not yet disclosed the notes’ interest rate, issue price, or final closing date in its public announcement.

Completion of the private placement remains dependent on market conditions and other customary requirements, according to the company. CleanSpark also said there was no assurance that the transaction would close under the proposed terms or at all.

If the amount raised is insufficient to finish the Sandersville facility, CleanSpark will provide a customary completion guarantee. Under that agreement, the Nasdaq-listed parent would supply the issuer with the additional money needed to complete the project, subject to the guarantee’s final terms.

The guarantee adds a direct obligation for CleanSpark even though CSDC Finance I would issue the notes. Investors will need the final offering documents to assess the interest cost, covenant package, construction timetable, and conditions governing access to the reserve accounts.

For U.S. shareholders, the financing adds project-level debt exposure to a company whose common shares trade on Nasdaq under the CLSK ticker. Since the placement is private, the notes will not be offered through a general public securities sale under the announced structure.

CleanSpark stock finished Thursday at approximately $13.40, gaining 4.73% during the session. The move followed the financing announcement, though the trading data alone does not establish that the notes proposal caused the advance.

Sandersville funding supports a long-term data center lease

Construction financing for Sandersville follows CleanSpark’s July announcement of a 20-year infrastructure lease with an unnamed investment-grade global technology company. CleanSpark said at the time that the agreement covered 175 megawatts of compute capacity at the Georgia campus.

Under CleanSpark’s July announcement, the initial lease term could generate $6.6 billion in contracted revenue. Two optional five-year extensions could increase the total contract value to $11.6 billion if the tenant exercises both options.

The company expects the initial Sandersville capacity to become available beginning in the fourth quarter of 2027. CleanSpark has not publicly identified the customer, meaning reports naming Meta as the tenant remain unconfirmed by the company’s financing announcement or its original lease disclosure.

CleanSpark acquired the Sandersville Bitcoin mining facility from Mawson Infrastructure Group in October 2022. At the time, the purchase included nearly 6,500 mining machines representing about 560 petahashes per second of computing power.

The company said in 2022 that the Georgia site had a planned capacity of 230 megawatts. Its later data center agreement assigned 175 megawatts to high-performance computing, placing the campus at the center of its expansion beyond revenue generated from Bitcoin mining.

CleanSpark’s corporate website now describes the company as a large-scale digital infrastructure developer with a U.S. portfolio serving Bitcoin mining and compute-intensive workloads. The revised description follows several quarters in which management discussed using the company’s land and power holdings for artificial intelligence infrastructure.

For former mining sites, access to power and grid connections can reduce part of the preparation needed for data center development. CleanSpark’s disclosures, however, show that converting Sandersville still requires more than $2 billion in proposed financing and a completion commitment from the parent company.

CleanSpark’s Bitcoin production rose in August

Alongside its data center plans, CleanSpark has continued to operate one of the largest publicly traded Bitcoin mining businesses in the United States. Its August operational update showed production of 593 BTC, up from 586 BTC in July rather than slightly lower, as stated in the original report.

August output lifted CleanSpark’s 2026 production to 4,903 BTC through the end of the month. The company had reported 4,310 BTC produced through July, with an average daily output of 18.91 BTC during that month.

CleanSpark held 13,703 BTC as of Aug. 31, according to its latest operational figures. Its treasury had contained 13,931 BTC at the end of July, producing a monthly decline of 228 BTC even as the company mined another 593 BTC.

The July update said CleanSpark sold 229 BTC on the spot market and delivered 350 BTC under call-option contracts. Including option premiums, the company reported an average realized price of $66,133 per Bitcoin for the transactions.

Bitcoin was trading near $76,300 on Sep. 17 after recovering from a decline toward $75,000, according to recent market coverage from crypto.news. The report placed nearby resistance around $77,000 and $78,000 while daily momentum remained under pressure.

Mining economics had already weakened earlier in the summer as the value produced by each unit of computing power declined. In June, miner profitability fell as hashprice dropped by nearly 18% over 30 days to about $30.77 per petahash per second.

CleanSpark reported fiscal third-quarter revenue of $198.6 million for the three months ended June 30, up from $104.1 million a year earlier. According to its quarterly results, the company recorded a net loss of $236.2 million, compared with net income of $379.4 million in the same period of 2025.

The quarterly filing attributed much of the loss to changes in the fair value of the company’s Bitcoin holdings. CleanSpark also reported $933.3 million in cash and Bitcoin as of June 30, while total debt stood at $1.8 billion before the newly proposed Sandersville notes offering.

The CFTC has granted conditional broker-registration relief to passive software providers under a no-action position that sets 10 requirements for developers offering tools connected to regulated derivatives trading.

CFTC relief covers passive derivatives software

The CFTC’s Market Participants Division said in a Sep. 17 release that it had issued a no-action position for providers of passive software used to facilitate derivatives trading.

Under the position, division staff will not recommend that the Commission take enforcement action against a qualifying provider or its relevant personnel for failing to register as an introducing broker or an associated person of an introducing broker. The protection applies only to activities covered by the letter and remains subject to its stated conditions.

Software providers can qualify when their products allow users to trade with registered futures commission merchants, introducing brokers and designated contract markets. Users must remain customers or direct members of the regulated entity handling their transactions rather than becoming customers of the software provider.

Although the headline refers to crypto developers, the CFTC’s language covers passive software providers involved in regulated derivatives markets. Crypto wallet developers and other digital-asset software companies may fall within the framework when their tools connect users to eligible derivatives products, but the position does not provide blanket protection for every developer or crypto application.

Staff Letter 26-25 makes the position available to qualifying providers after the agency gave similar treatment under Staff Letter 26-09. The earlier letter addressed a request involving software that gave users access to regulated derivatives while leaving trade execution, customer accounts, and asset control with registered firms.

The new position is not a formal exemption from the Commodity Exchange Act. According to the CFTC’s description of its staff-letter process, a no-action letter means the issuing division will not recommend enforcement for failure to comply with a specified legal provision. It does not change the law or bind other divisions in the same manner as a Commission rule.

Ten conditions limit the registration relief

Among the 10 conditions, a provider and the personnel engaged in covered activities cannot be subject to statutory disqualification. Such disqualifications can include certain convictions, regulatory orders, or other legal findings that prevent a person from taking part in registered derivatives businesses.

Customers using the software must have a direct relationship with the registered exchange or intermediary serving them. They must also be able to access the registrant without using the provider’s software, which prevents the developer from becoming the customer’s only route to the regulated firm.

The provider cannot publish advertising or promotional material that would require advance approval from the National Futures Association if the business were registered as an introducing broker. While developers can market their software within the letter’s limits, the condition restricts conduct resembling regulated brokerage promotion.

To use the position, a provider must file a notice with the Market Participants Division and agree to satisfy every condition. The filing must also include consent to the CFTC’s jurisdiction to investigate the provider and pursue enforcement over violations connected to its covered activities.

Relief will remain in place until the effective date of any Commission rule or guidance dealing with how introducing-broker requirements apply to the covered software activity. A future rulemaking could therefore replace the staff position with a permanent framework or impose a different registration test.

The registration question matters because introducing brokers normally solicit or accept orders involving futures, commodity options, swaps, or certain retail commodity transactions without holding customer funds. Passive software can perform parts of that process through code even when its developer never controls assets or executes the transaction itself.

As previously explained by crypto.news in its review of the CFTC registration structure, introducing brokers sit alongside futures commission merchants, designated contract markets, clearing organizations and other regulated participants in the U.S. derivatives system. Each category carries separate registration, conduct and compliance duties.

CFTC action gives U.S. developers a defined route

For developers serving U.S. customers, the position provides a way to offer qualifying tools without immediately taking on the full duties attached to introducing-broker registration. Access remains tied to CFTC-regulated businesses, while developers must stay inside the limits covering customer relationships, marketing and regulatory oversight.

American users do not receive permission to trade products that would otherwise be unavailable to them. The letter concerns the registration status of the software provider, not whether a particular derivative, exchange or customer transaction complies with U.S. law.

The CFTC also retains its enforcement powers outside the narrow registration issue covered by the letter. Fraud, manipulation, unlawful solicitation and breaches of the conditions can still trigger regulatory action, while registered exchanges and intermediaries remain responsible for their own duties under the Commodity Exchange Act.

Regulated crypto derivatives already sit inside the agency’s jurisdiction. Futures, options, and swaps tied to digital commodities must trade through the applicable U.S. regulatory structure, and the CFTC has previously brought cases against offshore platforms accused of offering leveraged crypto products to American customers without registration.

For passive wallet and interface providers, control over customer property and trade decisions can be central to whether their conduct remains within the letter. A developer taking custody, recommending trades, generating explicit buy or sell signals, or acting as the customer-facing intermediary could present facts outside the passive model addressed by the CFTC.

SEC and CFTC use existing powers after CLARITY setback

The CFTC announcement arrived on the same day that the Securities and Exchange Commission issued a separate five-year trading exemption for eligible venues offering tokenized National Market System stocks.

Under the SEC order, approved venues may use permissioned automated market makers and liquidity pools for tokenized stock trading. Covered tokens must provide the same rights and privileges as the traditional shares they represent, while synthetic products that merely track a stock’s price do not qualify.

Eligible venues face limits on supported stock symbols and trading activity. Smart contracts must be public and auditable, and trading in a tokenized share must stop when the primary exchange halts the underlying stock. The SEC also requested public comments as it considers possible changes to the framework.

Both agency actions have followed the Senate’s failure to advance the Digital Asset Market CLARITY Act. Senators rejected cloture on Sep. 15 by 50–49, leaving the motion 10 votes short of the 60 required to begin debate.

The bill sought to divide digital-asset oversight between the SEC and CFTC while establishing registration routes for exchanges and other intermediaries. Seven Senate Democrats who opposed cloture have since reopened negotiations, although no second procedural vote has been scheduled.

Separate from the market-structure bill, the House Ways and Means Committee advanced the Digital Asset Tax Certainty Act in a 38–5 vote on Sep. 16. The proposal addresses staking rewards, digital-asset lending, wash-sale rules, dealer treatment and a proposed exemption for certain network and transaction fees of up to $10.

Without art fairs, today’s highly globalized and commercialized art world would not exist. While many galleries complain about the high cost and grueling travel required to participate in international trade shows, they also rely on them to expand their clientele and turn buying art into an event. As chief executive of Art Basel, the most famous brand in art fairs, Noah Horowitz understands this paradox well. Since he took on the role in 2022, he has doubled down on Art Basel’s core business, most visibly by allying with the Qatari royal family to launch the firm’s fifth annual fair in Doha this past February and shepherding its Paris show to the historic Grand Palais in 2024. But he has also expanded the brand’s reach in forward-looking ways, including by augmenting its fairs with the dedicated digital art section Zero 10 and a retail shop for branded and artist-created merchandise, as well as diversifying Art Basel’s partnerships lineup with big names like Miu Miu, Samsung, and Qatar Airways. “I felt there was more Art Basel could do proactively and creatively… to meet an evolving market where it was,” Horowitz says. Now, he and his team are “working double time” to get there. 

US authorities on Thursday announced sanctions against Iranian crypto exchange BitBank, accusing it of processing Bitcoin paid by ships transiting the Strait of Hormuz.

The US Department of the Treasury’s Office of Foreign Assets Control said that as of June, the Hormuz Safe Marine Services Authority used BitBank to transfer payments it received to the Islamic Revolutionary Guard Corps. The Treasury alleged it is part of the architecture used by Iranian financier Babak Zanjani to move hundreds of millions of dollars in Bitcoin to the IRGC.

Treasury has previously alleged Hormuz Safe is part of an IRGC-backed scheme forcing vessels to buy maritime insurance for passage, including coverage against seizures by Iran itself.

“Today’s designations of Iranian digital asset infrastructure make perfectly clear that efforts to finance the Iranian regime using cryptocurrencies are not beyond OFAC’s reach,” said US Treasury Secretary Scott Bessent. 

The designation is the latest Treasury action aimed at isolating Iran from the international financial system, including through sanctions on digital asset exchanges. 

The OFAC designations include BitBank, its developer Pishtaz Simorgh Electronic Trade Company and three associates of Zanjani, with the Treasury calling them “key components of the Iranian regime’s digital assets-based sanctions evasion infrastructure.”

Cointelegraph reached out to BitBank for comment. 

Iran’s BitBank is a separate entity from bitbank, inc, a fully licensed crypto exchange founded in 2014 in Japan, which was acquired by SBI Holdings in June. Treasury’s designation lists BitBank as having been established in 2024. 

Related: Bitcoin tops $79K, oil falls as Trump says Iran war could end 

In August, the US sanctioned two digital asset exchanges, Shelbit and Aban Tether, accusing them of assisting the Iranian regime in sanctions evasion. Treasury also sanctioned four crypto exchanges, including the country’s largest, Nobitex, in June. 

In July, the US government ordered the freezing of more than $130 million in USDt held in wallets linked to Iran. 

Iran has reportedly sought to mitigate the impact of tightening financial restrictions. Earlier this month, the Financial Times reported that Iran’s central bank eased foreign currency controls to encourage businesses to bring overseas earnings home, including through cryptocurrency, amid tightening US sanctions. 

Magazine: North Korea drives onchain malware surge, CoinEx shuts: Asia Express

Onchain attacks are accelerating fast, with new research from Chainalysis pointing to a sharp rise in malware activity across public blockchains. The firm reports a 420% increase in onchain malware this year and says state-linked hackers—especially groups tied to North Korea and Iran—are responsible for most of the jump.

Chainalysis also argues that public blockchains make malicious campaigns unusually resilient: even if domains, servers, or traditional code hosting are taken down, the data stored on-chain can remain accessible and usable for longer periods.

Key takeaways

• Chainalysis attributes the majority of this year’s 420% surge in onchain malware to state-linked hackers, particularly those linked to North Korea and Iran.
• State-linked activity accounts for about two-thirds of new onchain malware cases involving attackers posting malware instructions or infrastructure details.
• Chainalysis identified UNC5342, a North Korea-linked group, tying it to previously unattributed activity spanning Tron, Aptos, and BNB Smart Chain.
• Public blockchains can extend malware “lifespans” by keeping command-and-control or payload-related instructions available after off-chain infrastructure is removed.

State-linked activity drives the onchain malware spike

Chainalysis’ report centers on how attackers are increasingly using public blockchains not just to move funds, but to store malicious instructions and supporting infrastructure information. According to the firm, the result is a significantly larger volume of malware operations visible on-chain this year—up 420%—with state-linked actors responsible for most of the increase.

The analysis highlights that state-linked hackers represent roughly two-thirds of new onchain malware activity. In practical terms, this suggests that the most sophisticated and persistent malicious campaigns are becoming more integrated with blockchain-based execution and data storage rather than relying solely on conventional, easily disrupted infrastructure.

Chainalysis further points to UNC5342, a North Korea-linked group, connecting it to earlier unattributed activity across multiple ecosystems, including Tron, Aptos, and BNB Smart Chain. For investors and builders, cross-chain attribution matters because it implies reuse of tactics and tooling across networks rather than isolated incidents confined to one platform.

Why public blockchains can make malware harder to eliminate

One of Chainalysis’ most important arguments is that onchain storage changes the operational economics of malware. Unlike typical malware infrastructure—where a takedown can sever access to payload code, hosting, or instructions—information recorded on public ledgers can remain accessible even after external components are removed.

Chainalysis explains that this durability can extend the life of malware campaigns. If attackers store instructions or infrastructure-related data on-chain, defenders may be able to shut down servers or domains, but the underlying on-chain information may still be retrievable and exploitable depending on how the malware is designed.

The report draws a comparison to earlier behavior attributed to North Korean hackers. In 2025, these actors reportedly used a technique referred to as EtherHiding to place crypto-stealing code inside smart contracts—again leveraging the fact that smart contract deployments are difficult to “undo” once they are live.

Attribution across chains signals broader threat tooling

Chainalysis’ identification of UNC5342 across Tron, Aptos, and BNB Smart Chain emphasizes a trend security teams have increasingly observed: attackers are treating chains as interchangeable environments for distribution, execution, or storage of malicious components.

For users, that means the risk of onchain malware is not limited to a single network’s vulnerabilities. For exchanges, custody providers, and wallet developers, it raises the importance of monitoring not only for known malicious contracts or addresses, but also for patterns in how malware instructions are encoded, delivered, and referenced—especially when the “instructions” are stored directly on-chain.

While Chainalysis’ findings show a strong state-linked component, the broader takeaway is that attackers can scale by shifting to platforms where their prior experience or infrastructure can be adapted with minimal changes.

What to watch next in onchain defense

As Chainalysis reports more state-linked actors adopting onchain methods, the immediate focus for the market should be on faster detection of onchain malware patterns and more robust controls around smart contract interactions, data indexing, and monitoring of malicious instructions stored on-ledger.

Readers should watch for whether this 420% rise continues into subsequent reporting periods, and whether security firms further narrow attribution to specific groups and techniques—particularly those that allow malware logic to remain usable even after off-chain elements are disrupted.