Bitcoin climbed past $87,000 after a rate increase that should have made risk harder to own. The public record identifies several sources of demand, but it cannot put a name to every buyer or turn fund inflows into a complete account of the rally.

Bitcoin’s rally after the Federal Reserve raised interest rates has an answer that can be measured, though not a single buyer who can be named. Money returned to US spot Bitcoin exchange traded funds. A public company resumed purchases. Traders caught on the wrong side of the rise had to close positions. By September 21, Bitcoin had moved above $87,000, then surrendered part of the gain two days later.

The timing matters. The Federal Open Market Committee raised its target range by a quarter point to 3.75% to 4.00% on September 16. Its September projections put the median year end policy rate at 4.1% in both 2026 and 2027. In June, those medians were 3.8% and 3.6%. The Fed did not promise a cut.

JUST IN: Chance of a September Fed rate hike rises to 81% on Polymarket

The odds for a 25-basis-point hike jumped after August CPI, with core inflation rising 0.3% m/m versus 0.2% expected. pic.twitter.com/Yf6ztlzGnW

— crypto.news (@cryptodotnews) September 11, 2026

A hike had been expected by many traders. Expectations alone, however, cannot account for the subsequent purchases. The useful question is narrower: which observable channels brought demand into Bitcoin after the decision, and which claims about the buyers go beyond the evidence?

The funds first lost $746 million

Farside Investors’ daily fund table records $450.4 million of net withdrawals from US spot Bitcoin ETFs on September 15 and another $295.9 million on the day of the Fed decision. Add them: $746.3 million left over two trading sessions. The decision was hardly greeted by an immediate flood into the funds.

The direction changed on September 17. Funds took in $159.5 million, followed by $433.0 million on September 18, $999.0 million on September 21 and $714.7 million on September 22. SoSoValue’s September 23 figures, reported by crypto.news, add $346.98 million for a fifth consecutive positive session.

Together, the five figures total $2,653.18 million. Subtract the $746.3 million of withdrawals from September 15 and 16 and the eight trading days show a net $1,906.88 million entering the funds. The latter is an accounting window, not a measure of money that bought Bitcoin at the rally’s exact hour. It is the net of two sharply different periods, and reporting only the five positive sessions would conceal the withdrawals immediately before the turn.

There is a data trap here. An earlier snapshot of Farside’s September 23 table showed only $32.4 million, with several issuers’ entries still blank. The later SoSoValue reading included $166.29 million for BlackRock’s IBIT and $143.24 million for Fidelity’s FBTC, among other reported fund flows. Treating a blank as zero would understate that day’s total by more than $300 million. These are dated snapshots, and totals can change when issuers report.

The apparent buyers changed between Monday and Wednesday

Monday’s $999.0 million was spread among several funds. Farside recorded $381.4 million for BlackRock’s IBIT, $289.1 million for ARK 21Shares’ ARKB and $238.8 million for Fidelity’s FBTC. Combined, those three accounted for $909.3 million, or about 91% of that day’s total. This identifies fund vehicles, not the institutions or people placing orders through them.

Tuesday’s flow was $714.7 million in Farside’s later table. IBIT received $350.3 million and FBTC $257.4 million. Those two accounted for about 85% of the daily total. By Wednesday, Bitcoin had retreated toward $84,000 even as SoSoValue reported another $346.98 million into the funds.

That final pairing is as important as the Monday surge. A positive ETF print does not guarantee a positive Bitcoin session. Fund subscriptions are one channel of net demand; sellers on exchanges, derivatives positions and the timing of fund hedging all affect the price. The five day fund streak establishes persistent subscriptions. It cannot prove those subscriptions alone pushed Bitcoin through $87,000.

The concentration figures matter for the same reason. On Monday, IBIT, ARKB and FBTC supplied more than nine tenths of net additions; that does not mean three asset managers independently decided to buy Bitcoin with their own balance sheets. A fund can receive orders from brokerage customers, registered advisers and institutions. The issuer reports the fund level flow. Its table does not sort the orders by investor type. Calling all $999 million institutional buying would add a claim the data do not contain.

Monday and Wednesday also illustrate why two kinds of accounting should stay separate. A fund flow is a net change in assets associated with subscriptions and redemptions. A traded fund share can change hands repeatedly between investors in the secondary market without producing the same amount of new fund creation. Price, exchange turnover and ETF net flow are different measurements. A headline can be accurate on one and misleading on another.

ETF inflows are net creations or subscriptions valued in dollars, not a public register of every underlying investor or a second by second ledger of coins bought. Market makers and authorized participants can bridge a fund trade and its underlying hedge at different times. Nor does a dollar flow translate into an exact Bitcoin quantity without choosing a price and knowing when the exposure was acquired. Converting $999 million into BTC at the day’s closing quote would produce an illustration, not an audited purchase count.

A corporate purchase is real, but its clock is different

Strategy provides a named buyer. Its September 21 Form 8-K reports the purchase of 950 BTC for $75.7 million, including fees and expenses, at an average $79,670 per coin. The transactions occurred between September 14 and September 20. The filing gives the period, not the individual trades’ timestamps.

That distinction rules out an easy claim. Strategy’s announcement landed on September 21, when Bitcoin rallied, but the filing does not show that Strategy bought Bitcoin during Monday’s surge. Its purchase may have happened before, after or across the September 16 rate decision. It used existing USD Cash and said it issued no shares through its at the market program during the period.

Strive’s September 21 filing identifies another corporate buyer: 1,355 BTC at an average price of roughly $79,475 during September 14 to 18. Its disclosure has the same dating problem for anyone trying to explain a particular candle. The combined reported 2,305 BTC shows corporate accumulation over overlapping periods; it does not measure corporate buying on September 21.

Strategy’s 950 BTC can be compared with its own past and future disclosures. It cannot simply be added to $2.65 billion of ETF inflows and called total market demand. The windows overlap, the units differ and other buyers and sellers are missing.

Some buyers were closing losing bets

The other identifiable class of buyer did not necessarily want to own Bitcoin for months. A trader short a Bitcoin perpetual or futures contract must buy back exposure to exit. If price rises quickly, liquidation can force that purchase. Those buy orders can add fuel to the move that made the short untenable.

Nansen senior research analyst Nicolai Sondergaard described the rally as a combination of ETF demand and short covering. A September 23 crypto.news account quoted CoinMarketCap research lead Alice Liu saying covering, rather than new buying, drove much of the rise. These are analysts’ interpretations, not a trader by trader audit.

One check comes after the peak. A CryptoQuant analyst’s exchange data, cited by crypto.news, showed Binance Bitcoin open interest falling from about $5.4 billion to $4.9 billion between September 21 and 23. Bitcoin had declined by then. Falling open interest shows positions closed, but it does not, on its own, separate shorts closed during the rally from longs unwound during the retreat. The $500 million change is a change in the dollar value of outstanding positions, not $500 million of confirmed short buying.

No comprehensive public tape identifies the beneficial owner behind each ETF order and each derivatives close. A forced short buy and a patient fund subscription may both lift demand, but they imply different things about what happens when price stops climbing.

The strongest case for lasting demand has a limit

There is a serious argument that the inflows represent more than a squeeze. Five consecutive positive fund sessions, worth $2.65 billion, spanned the climb and continued on September 23 after the pullback. The purchases were not confined to one fund. IBIT, FBTC and ARKB all drew substantial cash on September 21. Corporate filings show at least two companies buying during the surrounding week. Those are observable commitments, regardless of the Fed’s posture.

The opposing interpretation has a different strength. Bitcoin’s move to about $87,300 did not hold; price was back near $84,000 by September 23. The ETF print records subscriptions during a day, while the price reflects all orders at their execution times. If new fund cash keeps arriving as Bitcoin falls, it means sellers are meeting it. That does not make the fund demand imaginary. It means its price impact cannot be read directly off its dollar total.

Recent crypto.news coverage of the ETF streak reported the pullback alongside continuing inflows and falling Binance open interest. Those facts support a mixed account: underlying fund demand was present, while leverage amplified and then retreated from the move. The public numbers do not tell us the exact share attributable to each.

JUST IN: BitMine Chairman Tom Lee says Q4 could ignite one of the biggest market rallies of our lifetime

Lee’s outlook comes as Bitcoin rebounds from its summer lows, while broader markets face catalysts including the Federal Reserve’s rate decision, easing financial conditions… pic.twitter.com/zXGWtrlsBj

— crypto.news (@cryptodotnews) September 17, 2026

For a cleaner test, compare the next complete fund reports with the path of open interest after the rally. If subscriptions remain large while open interest stops contracting, the evidence for demand beyond traders closing shorts strengthens. If subscriptions dry up and the price keeps slipping, Monday’s surge looks more dependent on temporary buying. Neither pattern proves causation on its own, because the public series are aggregated across markets and reported at different frequencies.

There is a second timing problem. Bitcoin trades around the clock; US listed fund shares trade during US market hours. The biggest crypto move can happen before an ETF session opens or after it closes. A daily ETF total cannot be laid over a 24 hour Bitcoin candle as though both cover identical hours. Any precise account of Monday would require intraday spot order flow, fund creation timing and derivatives transactions on a common clock. The available public daily series fall short of that standard.

The Fed did not become a buyer’s signal

The Fed’s September statement said inflation remained elevated and economic activity was expanding at a solid pace. Its 2026 and 2027 median rate projections of 4.1% are each higher than in June. The September projection table is a set of participants’ assessments of appropriate policy, not a binding schedule of decisions, but it offers little support for a claim that a near term rate cut drove the immediate rally.

A risk asset can rise after a hawkish decision if the surprise was already priced, other yields fall, or buyers in its own market outweigh macro pressure. Those are possible mechanisms, not proof that one explains this week. The observed fund reversal begins September 17, one day after the announcement. By September 21 it was large enough to see without a macro theory: $999 million in reported net subscriptions.

The more revealing development came when price and subscriptions parted ways on September 23. That is where the original question becomes testable. If fund creations keep coming while short positioning stays less crowded and Bitcoin holds its gains, the evidence for sustained cash demand improves. If creations turn negative and the price loses the levels recovered after the decision, the short squeeze explanation gains weight. Neither result can assign every past trade to an individual investor.

What the public record can actually name

The records identify funds, companies and position types. They do not name the ultimate owner of IBIT shares purchased on September 21. They do not date Strategy’s 950 BTC to Monday. They do not show that every liquidation produced a spot Bitcoin purchase on an exchange.

What they do show is enough to reject two simple versions of the story. Bitcoin did not rally because investors immediately celebrated the September 16 hike: ETF funds lost a combined $746.3 million on September 15 and 16. Nor was the rebound just a chart artifact with no recorded cash demand: about $2.65 billion entered spot funds over the next five sessions, on the figures available September 24.

A public filing adds 950 BTC of Strategy purchases during September 14 to 20, while Strive reports another 1,355 BTC during September 14 to 18. Short covering plausibly accelerated the price move, but no audited decomposition of its contribution has been published. The answer is a set of buyers, operating on different clocks.

JUST IN: Public companies added only 5,900 $BTC in Q3 2026 as corporate Bitcoin buying slows sharply.

Glassnode data shows corporate treasuries now hold Bitcoin at an average cost of about $80,500, leaving the group roughly 6% underwater at current prices. pic.twitter.com/2CSGmrCGkR

Advertisement

— crypto.news (@cryptodotnews) September 18, 2026

What to watch

Daily ETF creations: Check the complete issuer table after every fund has reported; a blank cell is not a zero.

Fund concentration: A positive total spread across IBIT, FBTC and ARKB differs from one driven by a single product.

Open interest with price: Rising price and falling open interest can fit short covering; falling price and falling open interest can reflect long unwinds.

Corporate filings: Read transaction windows in each 8-K before assigning a purchase to a specific trading day.

Price against flows: Compare Bitcoin’s daily close with that day’s fund subscriptions. The September 23 divergence deserves more attention than an inflow headline alone.

FAQ

Disclaimer: This article is for information and educational purposes only and does not constitute financial or investment advice. Figures reflect regulatory filings and reporting available at the time of writing and change with each disclosure. Nothing here is a recommendation to buy, sell, or hold any security or asset. Always do your own research. Information is accurate as of September 24, 2026.

European financial watchdogs have warned on Sept. 23 that sufficiently advanced quantum computers could undermine cryptography securing blockchains, while CryptoQuant founder Ki Young Ju estimates 6.89 million BTC may have public-key exposure relevant to a future quantum attack.

The Joint Committee of the European Supervisory Authorities, comprising the European Banking Authority, European Insurance and Occupational Pensions Authority and European Securities and Markets Authority, warned that quantum computing could create major risks for cryptographic systems protecting transactions, communications, databases and blockchains.

The Sept. 23 Autumn 2026 risk update did not say a machine capable of breaking Bitcoin cryptography exists today. Its warning focused on preparation, noting that quantum-related security risks could emerge before commercially useful quantum applications become practical.

EU watchdogs say cryptographic risks could emerge early

In its risk update, the Joint Committee said quantum computing could improve financial processes, pricing, fraud detection and compliance monitoring. The same technology could eventually weaken cryptography used throughout financial infrastructure. The authorities wrote that “risks posed could also materialise faster than any commercially viable application.”

A separate ESMA technical analysis published in May examined the mechanics in more detail. It said sufficiently advanced quantum computers could use Shor’s algorithm against public-key schemes including RSA and elliptic-curve cryptography, or ECC. Bitcoin relies on elliptic-curve signatures for ownership and transaction authorization.

ESMA stressed that such attacks remain beyond current noisy intermediate-scale quantum, or NISQ, machines. Its report said systems capable of threatening existing cryptography are not expected immediately, but long migration periods make early preparation necessary.

IBM has taken a similar position on timing. The company said in April that fault-tolerant quantum systems could begin approaching cryptographic relevance by the end of the decade. IBM has not said a Bitcoin-breaking quantum computer exists now.

Bitcoin quantum exposure estimates depend on methodology

The amount of Bitcoin potentially exposed to a future quantum attacker remains disputed because researchers count address types and reused keys differently.

CryptoQuant founder Ki Young Ju estimated in February that approximately 6.89 million BTC could face quantum exposure under his methodology. His figure included roughly 1.91 million BTC associated with directly visible public keys and other coins whose keys may have been revealed through previous spending behavior. The estimate included dormant holdings attributed to early Bitcoin users.

Glassnode later produced a different calculation. Its May research measured 6.04 million BTC, or 30.2% of issued supply, as having public-key exposure at rest. Within that total, Glassnode classified 1.92 million BTC as structurally exposed because the output type reveals the key by design.

Advertisement

The Glassnode framework includes early pay-to-public-key outputs, bare multisig outputs and Taproot outputs in the structural category. Operational exposure covers situations where address reuse, partial spending or custody practices make a key visible while coins remain associated with it.

As crypto.news reported in its coverage of Bitcoin quantum exposure measured by Glassnode, the firm’s narrower structural measure put 1.92 million BTC directly in the category where public keys are revealed by design.

Exposed public keys create the Bitcoin-specific risk

Bitcoin ownership depends on digital signatures. For several common address formats, a public key may remain hidden behind a hash until coins are spent. Other output types expose the public key from creation, while address reuse can leave previously hidden keys visible onchain.

BIP-360, currently listed as a draft in the official Bitcoin Improvement Proposal repository, proposes Pay-to-Merkle-Root outputs designed to reduce long-exposure attacks against elliptic-curve keys. Its specification identifies P2PK, reused outputs and Taproot outputs among categories with long-exposure risk.

Advertisement

The proposal does not claim to solve every quantum attack path. BIP-360 notes that protection against an attacker deriving a key while a transaction waits for confirmation may require a post-quantum signature scheme.

BIP-361 addresses migration policy. The draft would eventually prevent new funds from being sent to quantum-vulnerable output types and later tighten spending rules for legacy ECDSA and Schnorr signatures. Its timetable begins only after a post-quantum output type is implemented and activated.

As crypto.news detailed in its Bitcoin BIP-360 and BIP-361 migration coverage, developers continue debating how dormant or inaccessible coins should be handled if legacy signatures eventually become unsafe.

Neither BIP is an activated Bitcoin consensus rule. The official BIP repository lists BIP-360 and BIP-361 as drafts, leaving the technical standard and migration policy unsettled.

Advertisement

Europe wants post-quantum migration to start in 2026

The European Commission already has a transition timetable covering public institutions and critical infrastructure. Its post-quantum roadmap calls for all EU member states to begin moving toward post-quantum cryptography by the end of 2026. High-risk use cases should complete the transition no later than the end of 2030.

The roadmap grew out of a Commission recommendation issued in 2024 and a coordinated implementation plan adopted in June 2025. A Sept. 2, 2026 consultation update said respondents favored clear deadlines, risk-based prioritization, hybrid cryptographic approaches and crypto-agility.

ESMA’s May paper set out another concern known as “harvest now, decrypt later.” Attackers can collect encrypted information today and store it until future computers become capable of decrypting it. The regulator said the long useful life of some financial information makes migration planning a multi-year security task.

For blockchains, migration involves an extra problem because existing assets and keys may need to move before older signature systems become unsafe. Bitcoin changes require consensus across developers, miners, businesses, wallet providers and node operators before new consensus rules can become active.

Advertisement

Institutional custodians have begun preparing without waiting for Bitcoin to choose a final signature system. In related coverage, crypto.news reported that Coinbase is designing post-quantum Bitcoin custody capable of supporting multiple potential signature schemes. Coinbase Chief Cryptographer Yehuda Lindell said the company wants its custody architecture to remain usable regardless of which system a blockchain ultimately adopts.

Ledger CTO Charles Guillemet has separately argued that migration may take years because changing wallets, custody systems and existing holdings can be harder than selecting a post-quantum algorithm. Crypto.news reported that Bitcoin’s quantum migration remains a wallet and coordination challenge while BIP-360 and BIP-361 remain drafts.

IBM has connected Digital Asset Haven to Swift’s blockchain-based shared ledger while opening an on-premises beta that lets regulated institutions keep digital asset operations inside their own data centers.

IBM said on Sept. 24 that Digital Asset Haven clients can access permissioned blockchain networks, including Swift’s ledger, through a beta ISO 20022 Messaging Adapter. The company said institutions can use familiar ISO 20022 messages to instruct tokenized deposit transactions instead of creating separate blockchain-specific payment workflows.

The release expands a platform IBM introduced in October 2025 for banks, governments and regulated companies managing digital assets. IBM originally built Digital Asset Haven to cover wallets, transaction orchestration, governance and key management across public and private blockchain networks.

IBM connects tokenized deposits to existing bank messaging

Through the new adapter, participating institutions can initiate tokenized deposit activity on Swift’s blockchain ledger using payment formats already embedded in bank systems. IBM said digital assets can move around the clock through the ledger before final settlement occurs through existing banking infrastructure.

IBM is connecting its digital asset platform to Swift’s blockchain network, letting banks move tokenized deposits 24/7

Banks can use the same payment messaging system they already use today pic.twitter.com/trcurowzqa

— Whale Alerts (@WhaleAlerts_08) September 24, 2026

Advertisement

Swift’s architecture separates payment execution from final settlement. Its ledger records and coordinates interbank payment commitments, while banks retain control of their assets, funding and keys. Settlement can continue through real-time gross settlement systems, correspondent banking arrangements or other agreed mechanisms.

The ledger uses an Ethereum Virtual Machine-compatible architecture based on Hyperledger Besu. Swift operates the shared orchestration layer, while participating banks continue using their existing compliance processes and payment applications.

IBM’s integration relies on ISO 20022, the financial messaging standard Swift completed migrating its cross-border payment network to in November 2025. The adapter is intended to let banks connect digital transactions with existing operational processes instead of replacing their payment messaging stack.

Swift ledger has 17 banks preparing tokenized payments

Swift declared its blockchain ledger ready for initial use in July after nine months of development work involving more than 40 financial institutions. Seventeen banks from six continents entered its first group preparing live tokenized deposit transactions.

Participants include ANZ, BNP Paribas, BNY, Citi, DBS, First Abu Dhabi Bank, FirstRand, HSBC, Itaú Unibanco, Lloyds Bank, Mashreq, MUFG, OCBC, Standard Chartered, UBS, UOB and Wells Fargo. Swift said the initial use case centers on 24/7 cross-border payments using bank-issued tokenized deposits.

In related coverage, crypto.news reported on the Swift ledger rollout involving 17 global banks after the infrastructure entered its first deployment phase in July.

Crypto.news later reported that HSBC and Standard Chartered completed a live interbank transaction through the ledger in August. The transaction connected the banks’ separate tokenized deposit systems while final settlement remained on existing banking rails.

Digital asset infrastructure provider Taurus has connected its custody and tokenization products to the same Swift infrastructure. Crypto.news reported in August that Taurus integrated with Swift’s tokenized deposit ledger, giving banks another route into the network.

IBM on-premises beta removes the public-cloud dependency

Alongside the Swift connection, IBM has opened Digital Asset Haven to an on-premises beta designed for IBM Z and IBM LinuxONE systems. The deployment keeps the software layer and key-management infrastructure inside the client’s own data center, without requiring public-cloud infrastructure.

Banks can use the deployment for assets including stablecoins and tokenized deposits. IBM said clients can install the platform on compatible IBM hardware already in their environments or add capacity based on operational requirements. The same architecture, APIs and workflows used in its SaaS and Hybrid SaaS products remain available in the on-premises version.

For key protection, IBM uses Crypto Express hardware security modules embedded within its infrastructure. Confidential computing and environment partitioning can separate production, testing and development systems, while IBM Offline Signing Orchestrator supports cold-storage processes.

Structured key ceremonies form another part of the beta. IBM said organizations can use formal processes for generating root certificate authority keys and produce audit documentation for regulators.

IBM said qualifying configurations can achieve 99.999999% availability, but the company specifies that the figure comes from internal measurements and projections using a defined hardware and software configuration. IBM states that other configurations may produce different availability results.

Digital Asset Haven originally launched with support for more than 40 connected public and private blockchains. Its existing services include programmable transaction approvals, wallet controls, HSM and multiparty-computation key management, compliance integrations and transaction monitoring.

IBM and Swift move from testing toward bank deployment

Demand for payment modernization remains part of the companies’ case for the new infrastructure. J.P. Morgan Payments reported that 93% of financial institutions are modernizing their payments infrastructure, citing investment in core systems and new payment products among current priorities.

Tom McPherson, general manager of IBM Z and LinuxONE, said financial institutions increasingly need traditional and tokenized assets to operate alongside one another. He said IBM’s Swift connection and on-premises deployment are intended to give regulated institutions more control over digital asset operations. IBM cautioned that statements concerning future product direction “are subject to change or withdrawal without notice.”

Institutions interested in the on-premises beta can currently join IBM’s waitlist. IBM’s product page describes SaaS, Hybrid SaaS and on-premises deployment as options for financial institutions operating wallet, transaction, governance and key-management services.

Swift is scheduled to discuss the ledger’s implementation during Sibos 2026, running from Sept. 28 through Oct. 1. Its agenda includes sessions on interoperable tokenized money, transaction capabilities and the ledger’s implementation roadmap.

Raiffeisen Bank International has built a group agreement with Bitpanda for its Central and Eastern European network. Its Austrian model is real. The 18 million customer figure measures the size of a possible rollout, not customers newly able to place a crypto order.

Raiffeisen Bank International announced a crypto deal for a network of around 18 million customers on September 23. The number is real as a measure of the bank group’s reach. It is not a count of people who gained crypto trading that day.

The bank’s release, published at 16:00 on September 23, calls its arrangement with Bitpanda Enterprise a group framework. Individual network banks will roll out services progressively to reflect local market needs. No list of launch dates or newly live subsidiaries appears in the announcement. The bank’s June 30 group snapshot counts 18.8 million customers, a more precise figure than the rounded 18 million in the headline.

JUST IN: Raiffeisen Bank International prepares to offer crypto access to customers

The $234 billion Austrian banking group is preparing to bring crypto services to its more than 18 million customers, expanding digital asset access through traditional banking infrastructure. pic.twitter.com/pklcKs9zf0

— crypto.news (@cryptodotnews) September 23, 2026

That leaves a question the customer total cannot answer. How many of those people could open their banking app on September 24 and buy bitcoin through this new agreement? The published release provides no number. It does not identify a newly launched country service.

The deal covers a network, not 18 million accounts switched on

RBI says it has subsidiary banks in 11 Central and Eastern European markets. Bitpanda will supply infrastructure for those banks to offer digital assets. The operative words are will supply and can offer. Each bank’s customer rollout is a later decision, according to the announcement.

RBI’s international network directory identifies the markets as Albania, Bosnia and Herzegovina, Croatia, the Czech Republic, Hungary, Kosovo, Romania, Russia, Serbia, Slovakia and Ukraine. Five are EU members: Croatia, the Czech Republic, Hungary, Romania and Slovakia. The others are outside the EU. The distinction matters for licences and product availability. An authorization to provide a crypto service across EU member states is not an authorization for every jurisdiction in the banking network.

The release does not assign a go live date to any of the 11. Nor does a bank customer count show how many customers are adults, use a compatible app, pass a new crypto onboarding check, live in a jurisdiction where the product is offered, or choose to trade. Every one of those steps reduces the path from total customers to actual users. None can be quantified from the agreement alone.

A useful audit starts with the named market, then demands a local bank product page, a dated launch notice, terms identifying the provider and evidence that the customer can complete onboarding. A press release about a group agreement satisfies the first step only. It would be false precision to turn the 18 million ceiling into a live access estimate without the later steps.

A market-by-market status check produces a narrower finding than the headline. The network directory verifies the banks, while the partnership release verifies a shared plan. It does not connect any one of those banks to a live Bitpanda consumer product under the new agreement. These are distinct evidence states, not an assertion that a bank can never introduce one or that a local service has been ruled out.

RBI market	EU member	Status in September 23 Bitpanda release
Albania	No	No named local launch
Bosnia and Herzegovina	No	No named local launch
Croatia	Yes	No named local launch
Czech Republic	Yes	No named local launch
Hungary	Yes	No named local launch
Kosovo	No	No named local launch
Romania	Yes	No named local launch
Russia	No	No named local launch
Serbia	No	No named local launch
Slovakia	Yes	No named local launch
Ukraine	No	No named local launch

That table is deliberately about disclosure in the announcement. It does not certify the absence of any unrelated crypto product at each bank, and it does not show that Bitpanda lacks a local licence. Its point is auditable: the company placed 11 banking markets next to an 18 million customer number without publishing an 11 market activation list. A subsequent country notice could change a row immediately.

The arithmetic of reach is therefore bounded on one side but not measured on the other. The upper number is the rounded group customer figure. The lower bound of customers newly enabled by the September announcement cannot be determined from public information, because the company did not disclose first day activation. Reporting the lower bound as zero would be just as unjustified as reporting all 18 million as active. A framework can exist before a customer sees anything new in an app.

There is a less obvious classification issue. A customer can belong to a bank group without being a retail mobile app customer eligible to open an investment account. The published total combines the group’s customer relationships across its network; the release does not provide the subset with a compatible mobile product, nor does it split corporate customers from retail customers for this partnership. Those missing pieces prevent even a reliable potential-user estimate.

The Austrian model exists outside the new CEE count

Bitpanda and RBI point to a working precedent. Raiffeisen Landesbank Niederoesterreich-Wien began offering access to Bitpanda in its banking environment in 2024. Its current customer page describes a route through the Mein ELBA app, trading from EUR 1 and recurring plans from EUR 10. The app asks a bank account holder to register for a personal Bitpanda account.

A second Austrian regional institution, Raiffeisen Salzburg, said on September 21 that its Bitpanda access had been available since August 2026. It described more than 650 crypto coins and tokens reachable from Mein ELBA. The local release says the banking app provides the route to an external provider and that Bitpanda performs the trades.

These are live product examples, not proof that an RBI subsidiary in Croatia, Romania or another CEE market is live under the September 23 framework. The corporate distinction is easy to miss because both sides use the Raiffeisen name. RBI’s own ownership diagram shows regional Austrian Raiffeisen banks owning around 61.17% of RBI, while the 11 CEE banks are its regional subsidiaries. The Austrian partnerships demonstrate a model that might be copied. They cannot be counted as launches inside the new 11 market program.

The two agreements should not be silently added together to produce a bigger customer pool. Even the 18.8 million figure is a group customer total, not 18.8 million distinct prospective crypto accounts. No customer conversion rate is supplied. Crypto.news’ initial report on the RBI deal described the reach as potential, which is the right qualification for the announced arrangement.

The app hands the customer to Bitpanda

The Austrian bank’s own terms show what a customer gets. On the Niederoesterreich-Wien product FAQ, a customer needs both a Raiffeisen account and an active Mein ELBA app. They then register for Bitpanda. The bank requires customers to be at least 18, hold a valid photo ID and reside in Austria.

The contractual split is more important than the app’s appearance. The page says customers become Bitpanda customers through the app’s Bitpanda access. It says purchases and sales take place exclusively with Bitpanda and assets are held inside Bitpanda’s structure. The bank receives a fee from Bitpanda for its access services. Austria previously fined Bitpanda EUR 70,000 under MiCA, another reason to identify the regulated provider accurately rather than describing the banking app as the trading venue. It says it is not itself providing the crypto or securities service and is not liable for Bitpanda’s performance.

JUST IN: Banks now account for nearly 23% of crypto providers registered under the EU’s MiCA framework.

The number of banks on the register has roughly doubled to about 80 since late June, signaling growing participation from traditional financial institutions in Europe’s… pic.twitter.com/V4bfiRDLhS

— crypto.news (@cryptodotnews) September 19, 2026

Advertisement

That is a distribution model. The bank supplies the familiar entrance and payment account; Bitpanda provides the specialist transaction and asset service. Raiffeisen Salzburg states an equivalent limit in plain terms: it offers access, while Bitpanda handles the trading. Its product disclosure identifies Bitpanda GmbH as the provider authorized by the Austrian Financial Market Authority under MiCA.

The economics run in both directions. A bank can add an investment function without building its own full trading infrastructure. Bitpanda can reach banking customers through a channel that already has their attention. Under the Austrian arrangement, the bank is compensated by Bitpanda. The parties have not disclosed the fee formula or said whether the new group arrangement uses identical commercial terms. A separate Bitpanda infrastructure agreement with IG Europe illustrates that distribution partnerships can differ in the type of partner and customer service offered. A statement about revenue for the CEE banks would therefore go further than the public record permits.

The phrase inside the banking environment can imply a seamless handoff, but even the mature Austrian offering requires a separate Bitpanda identity. Raiffeisen’s page directs the user to the app’s Discover section, then to an individual Bitpanda registration. A registered banking customer is not automatically an approved crypto customer. Bitpanda can apply its own onboarding criteria in addition to the bank’s age, identification and residency requirements.

That is not an incidental footnote. If the bank reaches millions of users but only a fraction of them complete crypto onboarding, the actual product population will be smaller than the bank’s customer base. The difference cannot be computed by treating installation of Mein ELBA as a proxy: having the app, finding the offer, applying, being accepted and placing a first order are separate events. The September release reports none of those figures for the new partnership.

The fee disclosure supplies another reason to keep roles straight. The Niederoesterreich-Wien page explicitly says Bitpanda pays Raiffeisen for access services. It does not publish the amount or say that the bank takes a percentage of each trade. Customers are told that trading fees will be displayed before they place an order. There may be a commercial benefit to the bank if customers adopt the product, but the terms alone do not let a reporter calculate that benefit. A projected revenue figure made by multiplying 18 million by a guessed trading fee would conflate account holders, traders, volumes and a confidential commercial arrangement.

For a customer, the legal boundary matters when something goes wrong. The Austrian FAQ says the bank does not take responsibility for Bitpanda’s service. That language is not a finding that a customer has no protection, and it cannot be copied into the terms of a not yet launched RBI subsidiary. It does show that bank branding and legal responsibility can sit in different places. A country launch should be read from its own contracts before a reporter tells customers whom to contact about execution or assets.

A bank app does not mean a bank holds the coins

The distinction affects what users can do after buying. The Austrian product page says transfers of assets from another crypto exchange into the app’s Bitpanda service are not possible. It advertises immediate movement of funds through the linked Raiffeisen account, but that does not imply an unrestricted crypto wallet integrated into the bank account. Trading fees appear before an order is confirmed.

The bank’s page places Bitpanda branded stock and commodity offerings next to crypto, then notes that those branded products are derivatives, not direct ownership of the shares or commodities. The point is not that every product has the same legal form. It is that the menu inside a bank app can contain several distinct agreements, issuers and risk exposures. The app’s single interface does not turn them into bank deposits.

This is the detail to seek when the first CEE subsidiary announces its own launch. Which legal entity contracts with the customer? Who has custody of the crypto asset? Does the app permit transfers to an outside wallet? How are trading fees shown? Will the customer have to open a separate Bitpanda account? The Austrian answer is documented. The CEE answer has not been announced market by market.

The existing arrangement gives a workable reporting test because an advertised service leaves traces: a product page, onboarding criteria, provider identity and terms. Counting those traces is more informative than counting a bank’s total customers. It can be repeated when each local RBI subsidiary makes an announcement.

A good rollout count needs a consistent definition. A bank announcing that its app has a Bitpanda tile is a narrower milestone than customers being able to complete an order. A registration path open to a small pilot group is narrower than availability to all eligible retail customers. A countrywide statement is narrower again than a reported active customer count. If RBI eventually reports a single group adoption figure, the methodology will matter: users who clicked through, accounts opened at Bitpanda and customers who actually purchased an asset are different populations.

The Austrian pages show why the last step is not assured by the first. A person can see Bitpanda inside Mein ELBA but be ineligible for the service because of residence or age, or decide against registering. A completed registration need not lead to a trade. A successful trade need not imply a customer moved assets outside Bitpanda. Each funnel stage has a different question attached. Bank announcements tend to state the broadest one because it makes the partnership legible. Financial reporting needs the narrowest verifiable one.

Two public figures illustrate the scale of the gap without estimating it. RBI’s 18.8 million describes existing group customers on June 30. Bitpanda’s reported 7.4 million users in 2025 describes the platform’s own base at a different date and under its own definition. Adding the two counts, or assuming their populations do not overlap, would be meaningless. Neither company has published the number of RBI customers with Bitpanda accounts through this new CEE agreement.

A disclosure by a subsidiary would supply the missing numerator. If a bank said 400,000 eligible customers could open the feature, that would show a live addressable group in that country, subject to its stated conditions. If it said 20,000 customers had registered with Bitpanda and 8,000 had traded, those would be adoption figures. Nothing in the September 23 release permits either number to be inferred. The absence is a reporting limit, not a reason to assume the commercial plan will fail.

Five EU markets do not make one regulatory market for the whole group

MiCA’s cross border service provision rule governs how an authorized provider expands to another EU member state after the required notification. RBI says just five of its 11 CEE subsidiary markets are in the EU. The remaining six include Albania, Bosnia and Herzegovina, Kosovo, Russia, Serbia and Ukraine. They do not become part of an EU crypto licence by virtue of their parent’s headquarters in Vienna.

That does not prove Bitpanda cannot serve customers in those countries. It means separate local analysis is required, and the September 23 release has not published a common licence covering all 11. A group technology agreement can be signed in one place while the consumer product requires authorization, banking integration and customer terms in another.

Russia makes a blanket statement about the network particularly hazardous. RBI’s network page lists its Russian subsidiary and says the bank is working on deconsolidation while reducing exposure. The September announcement does not say Russia will receive the Bitpanda product. It would be incorrect to call the full network an EU rollout, and equally incorrect to infer a Russian launch from the presence of Russia in the network directory.

The published 18.8 million is a consolidated bank customer measure. It is not split in the announcement into customers in jurisdictions eligible for this product and customers outside them. Dividing by 11 to estimate an average national opportunity, or multiplying by a guessed take up rate, would merely give an invented number a decimal point.

The split between EU and non-EU locations changes the practical rollout calendar. An EU authorization is a starting point for a notification process within EU member states. It does not itself determine whether a particular RBI bank has integrated an app, vetted the customer journey or decided to sell the same set of assets. In the non-EU markets, even the passporting starting point is missing. The companies would need to address the law and commercial arrangements that apply locally.

Russia illustrates why the list of subsidiary countries should not be casually translated into a deployment list. RBI says it is pursuing deconsolidation of its Russian bank. The partnership release makes no separate assertion about offering Bitpanda products there. The same care is needed in Ukraine, Kosovo and Albania: their inclusion in RBI’s network directory establishes ownership and distribution infrastructure, not local product approval. Neither a bank’s presence nor Bitpanda’s EU standing substitutes for a dated local offer.

Advertisement

The regulatory distinction also prevents a false comparison across Europe. The tally of banks on the MiCA register concerns EU authorized entities. It does not include a count of all RBI’s non-EU subsidiaries ready to distribute a crypto product. Listing an entity on a register and putting a functioning trading route in a retail banking app are separate operational milestones.

The strongest case for the deal is already visible in Austria

The partnership has more substance than a logo swap. The Austrian customer pages describe an app route, an onboarding process, minimum order size, recurring investment and trading terms. Salzburg says its offer has been live since August. A customer at a qualifying Austrian regional bank can encounter Bitpanda inside the banking app and fund trades from the associated account. Bitpanda has supplied working infrastructure, not just a plan.

There is a plausible business case for taking that setup into RBI’s regional network. Bank distribution gives Bitpanda a route to customers who might never open a stand alone exchange account. RBI can add a feature to its existing app ecosystem. Crypto.news reported that Bitpanda’s 2025 adjusted revenue reached EUR 371 million and its user count 7.4 million, providing context for the scale of the infrastructure provider. Neither figure measures revenue from this specific bank partnership.

The bank side has precedent as well. An analysis of the EU MiCA register found roughly 80 bank entities in its September 16 tally, up materially from late June. That is not evidence of 80 banks offering the same retail crypto experience, but it weakens the claim that a bank entering crypto must be an isolated experiment. RBI’s choice to negotiate a group framework follows a period of wider bank activity.

Advertisement

The case for the deal is therefore operational: the model already runs at specific Austrian regional banks, the partner has regulated infrastructure, and RBI has a large regional distribution network. What remains unproved is the conversion of that infrastructure into a service at named CEE subsidiaries, then into actual customers using it.

The next announcement will supply the first countable customer base

The September 23 release offers no start date, no list of customer eligible subsidiaries and no actual signups under the new agreement. It does not say whether all 11 banks will participate or specify what products each will offer. There is no published figure for live access through the CEE framework as of September 24.

A later launch in a named market will narrow the denominator. Even then, the bank’s total customers would measure theoretical eligibility, not the number who passed onboarding or bought an asset. The useful sequence is one bank, one local product, the stated eligibility rules, a verified live app route and, if disclosed, customers enrolled. Until that sequence exists, 18 million is an addressable network.

The Austrian terms offer a more concrete description of what the arrangement presently looks like: a bank customer registers with Bitpanda, trades with Bitpanda and holds assets in Bitpanda’s structure. The September 23 bank release says its CEE rollout will proceed progressively. Both statements can be checked against the first local launch.

Advertisement

What to watch

Named launch: A dated notice from one of RBI’s 11 CEE subsidiary banks, with an operational start date.

Eligibility: The local rules for residency, age, app access and Bitpanda onboarding.

Provider: The customer contract naming who executes trades and holds assets.

Product scope: Supported coins, deposits, withdrawals, outside wallet transfers and fees.

Advertisement

Usage: A disclosed number of onboarded customers or trades, clearly separate from the bank’s full customer base.

FAQ

Can all 18 million Raiffeisen customers trade crypto now?

The September 23 agreement does not say that. It describes a gradual rollout across a network of around 18 million customers and names no newly live CEE subsidiary.

Why does RBI elsewhere report 18.8 million customers?

The bank’s June 30 group snapshot uses the more precise 18.8 million figure. The partnership release rounds its potential regional reach to around 18 million. Neither is a count of active crypto accounts.

How many CEE subsidiaries have launched under the new deal?

The September 23 announcement gives no count or dated list of new launches. It describes a group framework and a progressive rollout. A public launch notice from each subsidiary would make the number verifiable.

Advertisement

Does Raiffeisen already offer Bitpanda in Austria?

Yes. Raiffeisen Landesbank Niederoesterreich-Wien offers access through Mein ELBA, and Raiffeisen Salzburg said its own access began in August 2026. These are Austrian regional bank examples, separate from the announced CEE subsidiary rollout.

Who holds the crypto in the Austrian app arrangement?

The Niederoesterreich-Wien product page says the customer contracts with Bitpanda and that trades and holdings sit in Bitpanda’s structure. The bank provides access and receives a fee from Bitpanda for that service.

Does MiCA allow the product in all 11 countries?

No single EU authorization covers all 11 CEE subsidiary markets. RBI says five are EU members. Services in the other six require their own local assessment.

Can Austrian app customers move crypto in from another exchange?

The Niederoesterreich-Wien FAQ says transfers from another crypto exchange into its Bitpanda app service are not possible. Future CEE terms have not been disclosed.

Advertisement

What would prove the 18 million figure has become actual reach?

Dated launches, local customer eligibility rules and reported active accounts would show it bank by bank. The current release supplies a possible network size, not a live user figure. This is educational analysis, not investment advice.

Disclaimer: This article is for information and educational purposes only and does not constitute financial or investment advice. Figures reflect regulatory filings and reporting available at the time of writing and change with each disclosure. Nothing here is a recommendation to buy, sell, or hold any security or asset. Always do your own research. Information is accurate as of September 24, 2026.

MeshWallet has raised $10 million in a private funding round to expand its gasless USDT wallet on TRON and build new services around its self custodial payments platform.

According to the Tallinn based company, the round was led by a group of private investors and small family offices, with the capital set to fund product development and the expansion of its user ecosystem.

MeshWallet focuses on removing the need for users to hold TRX when sending USDT over the TRON network. Under the standard process, a wallet needs enough network resources or TRX to cover transaction costs. MeshWallet instead settles the fee using USDT, allowing the sender to manage the transfer without keeping a separate balance of TRX.

The company is targeting a market where TRON has become one of the largest settlement networks for Tether’s USDT. TRON processed $2.1 trillion in USDT transfers during the second quarter of 2026, crypto.news previously reported, citing Messari data. USDT supply on the blockchain stood at $87.9 billion at the end of the quarter, accounting for 98.5% of its stablecoin supply.

MeshWallet removes the TRX requirement for USDT transfers

MeshWallet said its product was built around TRC20 USDT transfers, with users able to hold, receive and send the stablecoin without acquiring TRX specifically to pay transaction fees.

Gasless transactions do not remove the underlying cost of processing a blockchain transaction. Different networks and applications can instead handle transaction fees through mechanisms such as fee delegation, wallet subsidies or protocol level exemptions.

For MeshWallet users, the company handles the process within the wallet while presenting the cost in USDT. The interface is centered on a limited set of functions, including checking balances and sending or receiving TRC20 USDT.

MeshWallet said the model is intended for people who make occasional transfers as well as users who move stablecoins frequently for payments, trading or transfers to friends and family.

Businesses are another part of the company’s target market. MeshWallet said using USDT for both the transfer and transaction cost means companies do not have to maintain a separate TRX balance solely for network fees.

Accounting can consequently remain centered on one token against a business’s home currency, according to the company. MeshWallet said the setup is designed to reduce administrative work and make onboarding easier for businesses accepting or sending stablecoin payments.

TRON’s existing payment activity gives the wallet a large pool of USDT transactions to target. The blockchain crossed 15 billion transactions in August, when daily activity was running above 12.5 million transactions.

USDT recorded 2.55 million transfers worth $28.1 billion on TRON on the day covered by the report. The network held approximately $90.28 billion in USDT at the time, spread across more than 75.37 million accounts.

Self custody remains part of the MeshWallet model

MeshWallet operates as a self custodial wallet, meaning private keys remain on the user’s device instead of being stored by the company on a centralized server.

The company said its codebase is open source and that two independent security audits are underway. MeshWallet pointed to its Trustpilot presence as another source users can consult when assessing the service.

Self custody has remained central to product development among larger wallet providers as they move into payments, trading and other financial services.

MetaMask, for example, launched Money Account in June as a self custodial stablecoin product combining payments, trading and automated yield through one balance. Supported stablecoins can be converted into mUSD, with users able to opt into a variable yield without moving assets into a separate staking product.

Wallet developers have meanwhile been experimenting with different ways to reduce the number of steps required for onchain activity. For stablecoin payments, network fees remain one of those steps because a user can hold sufficient USDT for a payment while lacking the native token needed to move it.

MeshWallet is concentrating specifically on that problem within TRON instead of building a wallet around a large number of networks and tokens.

TRON remains a major network for USDT payments

TRON’s stablecoin activity continued to grow during the second quarter. Messari data showed average daily USDT transfer volume reached $22.8 billion, up 4.3% from the previous quarter.

The network accounted for 47.6% of tracked USDT supply at the end of June. TRON’s total stablecoin market capitalization reached a record $89.2 billion during the quarter before USDT circulation moved above $90 billion in July.

Transaction fees remain part of that activity even when wallet applications make them less visible to end users. TRON generated $699.4 million in network fees during the second quarter, according to Messari, up 15.9% from the previous quarter.

The concentration of USDT activity has made TRON a common network for direct stablecoin transfers. CoinDesk Research data cited in August found that roughly 93% of the blockchain’s stablecoin transfer volume involved transfers directly between addresses instead of interactions with protocols.

Smaller payments represented a sizeable portion of activity as well. The same research found that TRON handled 52% of transfers below $1,000 across blockchains with native Tether issuance during the second quarter.

MeshWallet funding comes as US crypto rules remain unsettled

MeshWallet announced its funding while U.S. lawmakers continue work on digital asset market structure legislation.

The company’s announcement pointed to President Donald Trump’s backing of the Digital Asset Market Clarity Act and said the proposal could establish a regulated framework for digital assets in the United States.

The legislation has progressed further since some of the procedural steps described in MeshWallet’s announcement, but it has not cleared Congress.

The Senate Banking Committee advanced the CLARITY Act by a 15 to 9 vote in May. A Senate procedural vote on September 15 later failed to reach the 60 votes needed to move the legislation forward, leaving further congressional action unresolved.

Senate Banking Committee Chairman Tim Scott said after the vote that nearly all Senate Republicans had voted to advance the bill and called on the Securities and Exchange Commission and Commodity Futures Trading Commission to establish digital asset rules while Congress continues its legislative work.

MeshWallet said the newly raised capital will be used to continue development and introduce more features to the wallet. The application is currently available through Google’s Play Store and Apple’s App Store.

Tokenized real-world asset deposits have more than tripled to $7.4 billion between Q2 2025 and Q2 2026 even as total DeFi deposits fell approximately 15%, according to CoinShares and Token Terminal.

CoinShares, in its Aug. 6 Hybrid Finance report produced with Token Terminal, reported that tokenized funds, stocks and commodities kept gaining usage across lending, spot markets and perpetual futures during a period of weaker crypto-native activity. The report covers distributed assets that can move outside the issuing platform and excludes networks such as Canton and Provenance from its main analysis.

CoinShares CEO Jean-Marie Mognetti described the company’s thesis as “finance is not being disrupted but rewired,” linking tokenized assets with DeFi lending, trading venues and high-performance blockchains. The statement represents CoinShares’ interpretation of the data, while the underlying usage figures come from Token Terminal.

RWA collateral grew while DeFi deposits contracted

Between Q2 2025 and Q2 2026, RWA deposits across lending protocols and decentralized exchanges rose from $2.3 billion to $7.4 billion. Over the same period, total DeFi deposits fell around 15%, according to the report. CoinShares attributed part of the DeFi decline to withdrawals and lower crypto asset prices.

Tokenised assets are moving beyond issuance.

Recent developments around Hyperliquid and Morpho show more activity moving into trading and lending.

Our latest Hybrid Finance research with @tokenterminal looks at how that shift was already taking shape onchain.

Advertisement

See the data… pic.twitter.com/nfKy5gzsQw

— CoinShares (@CoinSharesCo) September 24, 2026

Tokenized Treasury and multi-strategy products supplied much of the RWA collateral. The report named JTRSY, BlackRock’s BUIDL and sUSDS among the largest contributors, followed by private-credit products including JAAA, syrupUSDT, syrupUSDC and PRIME. Delta-neutral product sUSDe contributed another source of deposits.

Yield-bearing collateral remained concentrated on Aave, Morpho and Kamino. CoinShares said investors can continue earning income on some of those assets while using them for borrowing, lowering the opportunity cost of posting collateral.

Ethereum accounted for almost 70% of measured RWA deposits. Plasma ranked second in the report, helped by Aave’s expansion beyond Ethereum, while Kamino supported Solana’s share of the market.

Tokenized trading kept growing as crypto volume fell

Spot activity showed a similar divergence. Aggregate DEX trading volume, still dominated by crypto-native assets, fell approximately 70% year over year. RWA spot volume increased roughly 220% over the same Q2-to-Q2 period, although it started from a much smaller base.

Tokenized gold and funds generated much of the activity. CoinShares identified XAUT and PAXG as major contributors, while sUSDe volume increased after liquidity moved from Uniswap v3 to Uniswap v4. Tokenized equities were beginning to represent a larger share by the end of the measurement period.

More recent Token Terminal data indicates that equity activity continued growing after the CoinShares cutoff. On Sept. 8, Token Terminal measured tokenized stocks at a $3.19 billion market capitalization, with 6.3% deposited in DeFi and $9.70 billion traded on DEXs during the preceding 30 days.

On Base, tokenized stock DEX volume later reached $730.9 million over 30 days, with daily activity touching $100 million. In related coverage, crypto.news reported on Base tokenized stock volume reaching a new daily record, based on Token Terminal data from September.

RWA perpetual markets are expanding faster than spot use

Perpetual futures produced one of the strongest growth readings in the CoinShares study. Volume on TradeXYZ, an RWA-focused venue operating through Hyperliquid, increased approximately 20 times from launch while crypto-native perpetual activity weakened after October 2025.

Commodities, equity indexes and technology stocks accounted for much of the derivatives volume. Oil and precious metals generated heavy turnover, while S&P 500 and Nasdaq-100 contracts gave traders index exposure. Semiconductor stocks represented another active segment, according to the report.

Open interest grew alongside turnover. CoinShares said equity indexes and semiconductor stocks held a larger share of outstanding positions than commodities, even when commodities generated high trading volume. SK Hynix became one of TradeXYZ’s larger markets after listing.

Fresh September data shows that the trend continued beyond Q2. CryptoRank reported on Sept. 22 that perpetual DEX open interest had reached $19 billion, with RWA contracts accounting for roughly 24% of total open interest, up from around 6% at the start of 2026. The number of RWA markets across perpetual DEXs had surpassed 1,000.

Two days later, RWA perpetual DEX trading volume for Q3 reached $365 billion, up 32% quarter over quarter. Public equities contributed approximately $175 billion, close to 48% of the total. Crypto.news covered the $365 billion Q3 RWA perpetual DEX volume on Sept. 24.

Hyperliquid leads venue revenue despite lower sector income

CoinShares found that application revenue across lending and trading venues declined between Q2 2025 and Q2 2026 even while RWA activity increased. Crypto-native borrowing and trading still generated most venue revenue, leaving RWA growth too small during the period to offset lower activity elsewhere.

Hyperliquid generated the most application revenue among the venues included in the report. CoinShares attributed the gap to its derivatives trading activity and to Hyperliquid operating both the exchange and underlying settlement infrastructure.

Lending protocols showed a different revenue profile. Morpho, which CoinShares described as the second-largest lending platform in the comparison, lacked a protocol-level take rate, limiting the direct revenue captured from activity. Trading venues including Hyperliquid, Uniswap and Aerodrome carried the highest revenue multiples in the report’s valuation comparison.

More recent TradeXYZ data has strengthened the derivatives side of the picture. An independent Hyperliquid Research Collective report said the venue processed $202.36 billion during Q2, up 79.2% quarter over quarter, while equity perpetual volume rose 377% to $58.9 billion. Crypto.news reported on the TradeXYZ volume increase to $202 billion earlier in September.

Tokenized stocks are drawing faster retail participation

CoinShares found large differences in how investor groups use RWA products. Institutional products such as BlackRock’s BUIDL carried average wallet balances in the tens of millions of dollars, while xStocks balances were much smaller and more consistent with retail participation. The report cautioned that one wallet does not necessarily represent one investor.

Tokenized equities recorded the fastest holder growth among the RWA categories studied. CoinShares linked the faster expansion to smaller investment sizes, while institutional products attracted larger balances from fewer wallets.

The report put tokenized-stock value at roughly $2.2 billion during its measurement period. By Sept. 22, CryptoRank measured tokenized stock market capitalization at $3.5 billion, led by BNB Chain with approximately $1 billion, followed by Ethereum and Solana. CryptoRank said the three networks represented around 70% of its measured tokenized-equity market.

CoinShares measured yields across selected RWA strategies between approximately 3.2% and 5.5%. Tokenized Treasury funds sat near the lower end, while private credit, lending markets, vaults and delta-neutral funding strategies offered higher yields with different risk profiles.

The European Union has moved closer to tighter oversight of DeFi lending access after the European Banking Authority called for crypto borrowing and lending services to be brought within the scope of the bloc’s Markets in Crypto Assets framework.

According to the European Banking Authority, crypto asset service providers that connect customers to decentralized lending protocols could face new requirements if the European Commission decides to expand MiCA as part of its ongoing review.

The EBA wants the Commission to conduct a cost benefit analysis of legislative changes that would add the intermediation of crypto borrowing and lending to the list of services regulated under MiCA. Its recommendations go beyond centralized crypto lenders and consider how regulated firms provide customers with access to DeFi protocols.

Possible measures include suitability tests for users, limits on leverage and extra disclosure requirements. The regulator raised the prospect of restrictions involving lending products that use asset referenced tokens or e money tokens requiring authorization under MiCA.

A certification regime for DeFi lending protocols could be considered as another option, particularly where regulated crypto firms act as the gateway through which customers access decentralized lending services.

DeFi lending access could face MiCA checks

Crypto lending activity has been identified in at least 16 EU member states, according to research cited by the EBA. The authority said access to decentralized finance through crypto firms and the growing use of artificial intelligence tools are making the boundary between centralized and decentralized financial services less clear.

MiCA currently provides an EU wide framework for crypto asset issuers and crypto asset service providers, but lending and borrowing are not fully covered by its existing service categories.

A July policy position from the European Parliament had already put DeFi and lending on the regulatory agenda. Lawmakers asked the Commission to examine whether decentralized finance, staking, crypto lending and borrowing, NFTs and tokenized financial assets require further treatment under MiCA. crypto.news previously reported that the position did not change existing law but set out areas lawmakers wanted examined after MiCA’s rollout.

The EBA’s latest recommendations give the Commission a more detailed set of options for lending. Requirements could be placed on crypto firms that intermediate borrowing and lending or provide an interface through which customers reach DeFi protocols.

Such rules would depend on legislative changes. The Commission’s MiCA review consultation remains open until Sept. 30 and is intended to help determine whether the framework remains fit for purpose following its initial implementation. Feedback may feed into a report on MiCA’s application and could be followed by a legislative proposal if the Commission considers changes necessary.

Stablecoin lending is drawing separate scrutiny

Stablecoins form another part of the lending debate. The EBA said policymakers could consider restricting access to borrowing and lending involving asset referenced tokens and e money tokens that require authorization under MiCA.

The proposal comes days after European central banks called for MiCA’s restrictions on stablecoin remuneration to cover lending, borrowing and staking arrangements that can generate indirect returns for token holders.

Under the proposal described in the stablecoin yield review, the European System of Central Banks argued that crypto platforms could structure products outside services currently covered by MiCA in ways that effectively allow stablecoins to generate returns.

The EBA separately said existing MiCA requirements for issuers of asset referenced and e money tokens are broadly appropriate, while recommending changes for third country multi issuer schemes. As of Sept. 1, 39 e money tokens had been issued under MiCA, while no asset referenced tokens had received authorization, according to the authority.

Reserve requirements are under review as well. The EBA recommended reconsidering the minimum amount of reserves that issuers must hold as bank deposits while preserving risk management requirements.

MiCA review is moving into areas outside the original framework

The Commission opened its MiCA review in May to gather feedback on how the regulation is functioning and whether parts of the framework should be changed. The consultation covers crypto issuers, service providers, financial institutions, technology companies, industry groups and public authorities.

MiCA entered into application on Dec. 30, 2024, while its provisions covering asset referenced and e money tokens had started applying six months earlier. Transitional arrangements allowed some existing crypto companies to continue operating under national regimes before the bloc moved into full MiCA implementation.

Attention has since moved toward activities that were not fully addressed by the original regulation. Lending, borrowing, staking and parts of DeFi have become part of that discussion, while regulators have been examining where decentralized systems should fall within existing financial rules.

A June consultation by Malta’s financial regulator proposed a new category for DAOs and other DeFi entities. The Malta Financial Services Authority said many projects described as decentralized may not meet MiCA’s standard for full decentralization where control remains concentrated among identifiable participants.

Similar questions have emerged at the EU level over how decentralization should be assessed when protocols rely on interfaces, governance structures or companies that provide users with access.

Crypto lenders currently sit outside parts of MiCA

The gap can already be seen in the way some companies structure European services. Nexo said in July that custody and brokerage for customers in the European Economic Area were being provided through regulated German partners Tangany and DLT Finance.

Its Earn products and crypto backed loans, however, were offered separately and sat outside the MiCA and MiFID authorizations held by those partners.

Expanding MiCA’s list of regulated services could change the requirements that apply when a crypto asset service provider intermediates lending or gives users access to a decentralized lending protocol. The EBA has not proposed a final set of rules, and its recommendations form part of the Commission’s consultation process rather than legislation already agreed by EU institutions.

Beyond lending, the authority wants clearer rules for crypto asset classification, saying current uncertainty can create costs and delays when firms bring products to market. It recommended clarifying MiCA’s scope and definitions, including its boundary with other EU financial laws.

Reporting requirements for token issuers and crypto asset service providers are another area the EBA wants reviewed to support supervision and risk monitoring.

The authority’s recommendations will now feed into the Commission’s assessment of MiCA alongside responses from other regulators and market participants. Any decision to add crypto lending or specific requirements for access to DeFi protocols would require the Commission to move from the review process toward legislative changes.

Bitget CEO Gracy Chen said preliminary investigations indicate North Korean hackers may be behind the exchange’s $351.6 million security breach disclosed on Thursday. In a live Q&A on X after the incident, Chen pointed to investigator-identified IP addresses that align with VPN services previously used by a Democratic People’s Republic of Korea (DPRK) hacking group, adding that the attackers’ behavior resembled tactics from earlier campaigns.

Chen also said Bitget does not believe the breach involved an inside job. She further described the mechanics of the theft: investigators concluded that hackers moved funds directly rather than attempting to forge user withdrawal requests, and that the attackers did not obtain Bitget’s cold-wallet or hot-and-warm-wallet private keys.

Key takeaways

• Attribution signals: Bitget’s CEO cited preliminary links between specific IP addresses and VPN choices associated with a DPRK group.
• No inside-job assumption: Chen said the exchange does not currently believe there was an internal compromise.
• How funds were taken: Bitget described direct fund transfers, not forged withdrawal requests.
• Key security controls: Chen said investigators did not find evidence that private keys for cold or hot/warm wallets were accessed.
• Recovery efforts underway: Some stolen funds were reported recovered, though Bitget did not disclose an amount.

Why Bitget’s preliminary attribution points to DPRK activity

Chen’s most concrete evidence, at least at the stage described publicly, centers on network infrastructure. During the X Q&A, she said investigators identified some IP addresses that match the VPN selections used by a DPRK-linked group. She characterized the overall attack pattern as consistent with methods used in prior North Korean operations.

The CEO’s comments matter beyond headline attribution because they can shape how traders, institutions, and partners assess risk and incident timelines. If the VPN and behavioral indicators continue to hold up under forensic review, it strengthens the case that the breach is part of the broader pattern of state-linked cybercrime targeting digital asset infrastructure.

Bitget’s framing also echoes broader reporting on North Korea’s role in crypto theft. Cointelegraph previously noted that North Korean hackers were linked to an estimated $2.02 billion in crypto theft in 2025, including an approximately $1.5 billion Bybit hack that the FBI attributed to North Korea.

What Bitget says happened during the breach

Beyond attribution, Chen provided operational details about the alleged theft process. She said hackers accessed Bitget’s systems and transferred funds directly, explicitly adding that they did not forge user withdrawal requests.

Chen further stated that investigators have not found evidence that the attackers obtained private keys associated with Bitget’s cold wallet or its hot and warm wallets. She said the investigation is still focused on determining which internal systems were compromised and how the attackers gained access in the first place.

For users and counterparties, these distinctions are important. A breach involving private-key extraction typically suggests a different threat level and broader recovery challenges than an incident where attackers manipulate systems to move funds. Chen’s account—direct transfers without key compromise—implies Bitget’s security design may have contained the damage, even as attackers were still able to reach and move assets.

Withdrawals suspended; exchange reports partial recovery

Chen’s remarks come after Bitget reported unauthorized transfers impacting parts of its hot and warm wallet infrastructure. At the time of publication, withdrawals remained suspended, reflecting Bitget’s caution while it continues incident response and reconciliation.

During the Q&A, Chen said some of the stolen funds had been recovered, but she did not specify the amount. She also said the exchange is working with blockchain foundations and other partners on recovery efforts.

For market participants, exchange recovery timelines can materially affect liquidity and user confidence, especially when withdrawals are paused. Even partial recovery—without a stated figure—signals that defenders may have regained control of certain assets or succeeded in interrupting some of the flow after the compromise.

Earlier coverage from Cointelegraph noted the breadth of user-facing impact. In a report on Bitget’s response, Cointelegraph stated that the exchange confirmed the $352M security breach and suspended withdrawals amid reports of affected funds. (See: Bitget calls security withdrawal claims unverified amid $178m breach reports.)

What to watch next as the investigation develops

Chen’s public explanation provides a framework—VPN-linked IP indicators, a lack of evidence of private-key compromise, and a non-insider working assumption—but important questions remain open. Bitget is still determining the scope of compromised systems and the access method, and those findings are likely to influence how credible the DPRK attribution ultimately appears.

Going forward, readers should monitor whether Bitget expands on the technical chain of intrusion (for example, whether the breach began via compromised credentials, a system-level weakness, or some other vector) and whether partners or third-party incident analysts corroborate the VPN/IP and behavioral claims. As recovery continues and more forensic details emerge, the key issue will be whether the initial story holds—or whether additional evidence changes the attribution and the lessons other exchanges draw from the incident.

Bitget CEO Gracy Chen said North Korean hackers may be behind the exchange’s $351.6 million security breach on Thursday, citing preliminary findings linking IP addresses to VPN services used by a North Korean group. 

Speaking during a live Q&A following the incident on X, Chen said security investigators had flagged similarities with previous North Korean attacks. She said the exchange did not believe the breach was an inside job. 

“We’ve identified some IP addresses that match the VPN choices by a certain DPRK group,” Chen said, referring to the Democratic People’s Republic of Korea.

North Korean hackers were linked to an estimated $2.02 billion in crypto theft in 2025, including the roughly $1.5 billion Bybit exchange hack, which the FBI attributed to North Korea. 

Bitget CEO Gracy Chen hosts a live broadcast on X hours after the hack. Source: Bitget

“The pattern looks very much like what the North Korean team did before,” she said.

Chen also disclosed that hackers breached Bitget’s systems and transferred funds directly, rather than forging user withdrawal requests.

“They did not forge user withdrawal requests, nor did they obtain our private keys of the cold wallet and any hot, warm wallet,” she said. 

Chen said investigators were still determining which systems were compromised and how the attackers gained access.

Related: Bitget confirms $352M security breach, suspends withdrawals

The comments come after Bitget reported unauthorized transfers affecting portions of its hot and warm wallet infrastructure on Thursday. Withdrawals remain suspended at the time of publication.

During the Q&A, Chen also said some stolen funds had been recovered, without specifying an amount. She said the exchange was working with blockchain foundations and other partners on recovery efforts.

Magazine: Asia dominates Crypto Adoption Index, Bitget’s $351M hack: Asia Express

Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.