Crypto exchange maker and taker fees compared across eight major platforms for spot and futures trading in 2026.

The trading fee is the one cost you pay on every single order, win or lose, so over a year of activity it quietly becomes one of the biggest line items a trader faces. Most exchanges split that fee into two rates: a maker fee when your order adds liquidity to the book and rests there, and a taker fee when your order removes liquidity by filling against what is already there. A resting limit order is usually the maker side, and a market order that lifts the offer is usually the taker side. The gap between the two, and how far each falls as you trade more, is what separates a cheap venue from an expensive one.

This guide compares the maker and taker fees across eight major crypto exchanges, on both spot and futures, and looks at the first discount each one lets you reach, because the rate you can actually unlock matters more than a headline VIP tier you never will. Every figure was checked against exchange documentation, and where fees vary by product or region, we flag it.

Risk warning: Trading crypto, especially with leverage, carries a high risk of loss. Fees are only one part of the cost of trading. This article is informational and is not financial advice.

The fee comparison

The table is sorted by regular futures taker fee, cheapest first, since the taker rate is the number that hits most market orders. These are standard entry-tier rates before token discounts or VIP steps, checked against each venue’s fee schedule and cross-referenced with independent trackers like CoinGecko’s exchange rankings.

Two numbers can look identical and still cost you differently, because the discount path is where real money is saved or lost. A venue with a slightly higher regular taker but a discount you can actually reach can end up cheaper than one with a lower headline rate you will never qualify for.

What each exchange charges

MEXC is the cheapest on paper, with 0% maker and 0.050% taker on spot and 0% maker and 0.020% taker on futures as a standing policy rather than a promotion. There is no token to hold or threshold to clear for the base rate, and it pairs the pricing with a vast altcoin catalog, though liquidity thins on the smallest listings. If your only goal is the lowest published rate, MEXC leads.

Coinbase is a study in contrast: its perpetual futures are cheap at 0% maker and 0.030% taker, but Advanced Trade spot taker fees run as high as 0.60% at the lowest tier, so it is inexpensive for perps and pricey for casual spot buys. The premium buys regulatory standing and a polished, US-listed platform, and spot fees fall with monthly volume, but casual buyers pay the most of anyone here.

Binance sits at 0.10% spot and 0.020% maker with 0.050% taker on futures such as BTC USDT, and paying futures fees in BNB shaves off a further 10%. Its VIP ladder scales down further with volume or BNB holdings, so heavy traders push the effective rate well below the entry tier. Paired with the deepest liquidity in crypto, it is cheap where it counts for active traders.

OKX matches Binance on futures at 0.020% and 0.050%, with slightly lower spot maker fees at 0.080%, and layers on OKB-based discounts. Its VIP 1 is reachable at 50,000 USDT in assets on the futures side, one of the friendlier asset paths among the majors, which makes its effective rate competitive for a funded account.

Bybit charges 0.020% maker and 0.055% taker on futures, competitive on paper, but its first VIP discount needs $100,000 in assets, so most retail accounts stay on the regular rate. What offsets the distant discount is a fast matching engine and deep books on BTC USDT, so execution quality is part of the value even at the regular rate.

BloFin lists a regular futures rate of 0.020% maker and 0.060% taker on pairs such as BTC USDT, which is at the higher end of this group, but its discount path is the most reachable here. VIP 1 drops the taker to 0.0500% and is available with $50,000 in account assets, half of what the comparable Bybit tier requires, so a funded mid-size account actually reaches a cheaper rate rather than just seeing one advertised. You can compare its published schedule at this low-fee crypto exchange.

Bitget matches BloFin’s 0.020% and 0.060% regular futures rate, but its first VIP badge does not move the taker at all, which only falls at VIP 2, so the first upgrade many traders reach changes nothing on cost. In its favor, it lists more perpetual markets than almost any rival and adds BGB-token discounts, so the value is in the range it offers rather than the lowest single rate.

KuCoin also sits at 0.020% maker and 0.060% taker on futures, with spot around 0.10% and discounts through KCS-token holdings or 30-day volume. It supports up to 100x leverage across a broad perpetual catalog, so it is a capable mid-tier venue even if its fees are not the lowest here.

What it takes to reach your first discount

Most fee round-ups stop at the headline rate, but the tier you can actually reach is where real money is saved. Exchanges gate their first discount behind either a balance of assets held on the platform or a rolling 30-day trading volume, and those thresholds vary enormously. The table below shows the easiest path to a first meaningful discount on each venue, which is the part most comparisons leave out.

The pattern that matters is this: an asset-based path to a discount is rare, and where it exists the threshold decides everything. BloFin and OKX let a $50,000 balance unlock a lower futures rate, Bybit asks for double that, and Binance, KuCoin, and Coinbase mostly gate discounts behind trading volume you have to grind out. If you hold a funded account but do not trade millions a month, the asset-path venues are where your first discount is genuinely within reach rather than just advertised.

The standouts

Different traders optimize for different things, so the fee winner depends on the job:

• Lowest headline fees: MEXC, with 0% maker and 0.020% futures taker as a baseline, no token or threshold required.
• Best reachable discount for a funded account: BloFin, because a $50,000 balance unlocks a 0.050% futures taker where the comparable Bybit tier needs $100,000, so the discount is real rather than aspirational.
• Cheapest where it counts at scale: Binance, pairing a low 0.050% futures taker with the deepest liquidity, so your fills land near the mark as well as cheaply.

The lesson is that “lowest fee” and “lowest fee you will actually pay” are different questions, and the second one depends on your balance and volume.

Questions about trading fees

What is the difference between a maker and a taker fee? A maker order adds resting liquidity to the order book and is usually charged less or even rebated, while a taker order removes liquidity by filling immediately and is charged more. Binance Academy explains the maker-taker split in plain terms, and every rate in the table above is that split rather than a flat commission.

How do I actually pay the lower maker fee? Use resting limit orders instead of market orders where you can, since a limit order that does not fill immediately typically posts as a maker. Kraken’s help center has a clear walkthrough of how maker and taker fees are applied.

Do exchange-token discounts really help? They can, if you already hold or are willing to hold the token. BNB on Binance, OKB on OKX, and KCS on KuCoin all cut fees, but they add token exposure, so weigh the discount against holding an asset you might not otherwise want.

Are there fees beyond maker and taker? Yes. Funding on perpetual futures is a separate periodic charge between longs and shorts, and deposits, withdrawals, and network fees sit outside the trading fee entirely, so the maker-taker rate is not the whole cost of trading.

How to choose on fees

1. Match the rate to your order style. If you mostly post limit orders, weight the maker fee, and if you mostly take liquidity with market orders, weight the taker fee, since that is the one that hits you.
2. Look at the discount you can actually reach. A reachable first tier, like BloFin’s $50,000 path to a 0.050% taker, can beat a lower headline rate locked behind a threshold you will not hit.
3. Separate spot from futures. Some venues are cheap on one and expensive on the other, as Coinbase’s low perp fees and high spot fees show, so compare the product you actually trade.
4. Add up the whole cost. Factor funding, withdrawal, and network fees alongside maker-taker, and use a neutral reference like Investing.com’s crypto section to track the markets you trade while you compare venues.

The bottom line: MEXC wins on the lowest published fees, Binance is cheapest where liquidity matters most, and BloFin offers the most reachable discount for a funded mid-size account, so the right pick depends on your balance, your product, and how you send orders.

Nansen has integrated Outcome.xyz’s HIP-4 markets into its trading platform, becoming the first front end to support the venue as Hyperliquid opens its outcome-market infrastructure to outside builders.

According to a press release shared with crypto.news, the integration is live and initially gives Nansen users access to supported stock and crypto markets from Outcome.xyz alongside the platform’s existing onchain trading tools. Politics and sports markets are expected to be added as the offering develops.

Nansen said the arrangement is part of its plan to let users research and trade different types of markets through the same interface. Eligible traders using qualifying Outcome.xyz markets through Nansen can participate in a $1 million rewards pool, subject to the campaign’s terms.

The rollout comes shortly after Hyperliquid opened HIP-4 deployments to outside venues, creating a permissionless route for builders to launch outcome markets using the network’s infrastructure.

Nansen brings Outcome.xyz HIP-4 markets into its trading platform

Nansen has historically focused on onchain analytics, wallet activity and market intelligence, but the company has been adding execution features to connect its research tools with trading.

Under the Outcome.xyz integration, traders can examine market activity and take positions without moving to a separate front end. Nansen said users can assess who is taking positions on particular outcomes and where conviction is concentrated before executing through Nansen Trading.

“Prediction markets are having a real moment for a reason. People enjoy forming a view and putting it to the test,” Nansen co-founder and CEO Alex Svanevik said.

Svanevik said Outcome.xyz gives traders exposure to outcomes involving stocks, crypto, politics and sports, while Nansen connects that activity with its intelligence tools.

“What we’ve done at Nansen is make that decision a better-informed one, while closing the loop between intelligence and execution,” he added. “Traders can look at who is taking positions on an outcome, which outcomes have the strongest conviction behind them, and trade on that information directly in Nansen.”

Outcome.xyz co-founder Ahmed said distribution is important for a new market category and described Nansen as a natural partner because traders already use it for onchain research.

“For a new market category, distribution matters as much as market design,” Ahmed said. “Outcome, like Hyperliquid, is focused on meeting traders where they already are.”

The integration arrives as Outcome.xyz has quickly taken a leading share of activity among third-party HIP-4 venues.

On Sept. 3, crypto.news previously reported that HIP-4 daily volume nearly tripled within three days of Hyperliquid opening the infrastructure to outside venues on Aug. 29. Daily outcome volume increased from an August average of $545,000 to $1.97 million on Aug. 31, according to research cited in the report.

Outcome accounted for approximately 85% of the reported HIP-4 volume at the time, while another third-party venue, Skew, generated roughly 1%. The early activity came as Outcome ran its $1 million rebate campaign, which paid eligible users approximately one cent for every dollar traded.

HIP-4 has opened outcome market deployment to outside builders

HIP-4 was designed to support contracts tied to outcomes with fixed settlement conditions instead of the continuously priced instruments used for conventional perpetual futures.

The framework supports fully collateralized contracts without leverage, funding payments or liquidations. Contracts settle according to predetermined outcomes, allowing the infrastructure to be used for event-driven markets covering areas such as economic data, crypto, equities, politics and sports where supported.

Hyperliquid began moving toward permissionless HIP-4 deployment earlier this year. In July, the protocol outlined plans for outside deployers to create outcome markets after staking 500,000 HYPE, initially through testnet before the framework progressed toward open deployment.

Deployers can be penalized through slashing if they incorrectly settle a market or fail to settle it within the required period. The framework relies on templates approved by Hyperliquid validators, which limits deployments to predefined types of markets and settlement structures.

The permissionless system began producing outside venues by late August. Hyperliquid received its first reported builder-deployed outcome DEX after OUT registered through the HIP-4 framework, with onchain transactions showing the exchange deployed under the name OUT.

Two outside venues had each posted the required 500,000 HYPE bond by early September, according to research cited by crypto.news. Seven validator-approved templates were available for deployers at the time.

Outcome.xyz is among the earliest builders operating through the framework. Nansen’s support now gives the venue another front end through which traders can access its markets instead of requiring users to interact only through Outcome.xyz itself.

Hyperliquid has expanded from perps into event-based markets

Hyperliquid introduced HIP-4 after building much of its trading activity around spot markets and perpetual futures.

The protocol’s first U.S. macro event market under HIP-4 used the May 2026 CPI reading as its settlement event. Traders could use USDC to take positions on the year-over-year inflation print, with settlement based on official U.S. Bureau of Labor Statistics data.

That market demonstrated how HIP-4 could handle events with a defined expiry and outcome instead of relying on the perpetual structure used for continuously traded assets. The contracts were fully collateralized, meaning traders did not face the liquidation mechanics associated with leveraged perpetual futures.

Hyperliquid subsequently allowed validators to settle markets tied to offchain events, with the network’s validator system handling deployment and final settlement against specified data sources.

The structure differs from HIP-3, Hyperliquid’s framework for permissionless perpetual markets. HIP-3 has been used to create contracts tracking crypto assets as well as equities, commodities, foreign exchange and other traditional-market instruments.

Activity in that segment has already moved heavily into non-crypto products. TradeXYZ, the dominant HIP-3 deployer, recorded $202 billion in trading volume during the second quarter, according to an external research report published in early September. Its equity perpetual volume climbed 377% quarter over quarter to $58.9 billion across 55 markets.

TradeXYZ’s estimated share of Hyperliquid HIP-3 trading rose from 84.5% to 95.1% during the quarter, while open interest reached $2.96 billion at the end of June. The research estimated quarterly revenue at $7.59 million.

HIP-4 now gives builders a separate framework for markets whose value depends on a defined event or result. Outcome.xyz plans to expand from its initial stock and crypto offering into categories including politics and sports, while Nansen said support for the venue’s HIP-4 markets is already live through Nansen Trading.

Zcash price traded near $1,150 on Sep. 8 after a sharp six-day rally carried ZEC from about $814 to a multi-year high of $1,249, with derivatives liquidations and a major technical breakout supporting the move.

Zcash price consolidates after reaching $1,249

According to data from crypto.news, Zcash (ZEC) price was trading at $1,150.62 at the time of the daily chart snapshot, up 0.92% during the session. ZEC opened at $1,140.26 and moved between an intraday low of $1,113.66 and a high of $1,174.03.

The token remains about 8% below the $1,249.28 peak recorded on Sep. 6. However, the pullback has not erased much of the rally that began near $813.95 on Sep. 3. Based on those levels, ZEC gained more than 53% at its peak and was still up about 41% by Sep. 8.

Price action on the 4-hour chart shows ZEC consolidating between approximately $1,110 and $1,170 after the initial correction from the high. Buyers have repeatedly entered near the lower end of that range, although attempts to move beyond $1,170 have faced selling pressure.

The rally followed a derivatives-driven short squeeze that liquidated more than $46 million in bearish positions within 24 hours, according to the supplied market data. Forced position closures added buying pressure as ZEC crossed $1,000 and accelerated toward $1,250.

Daily trading volume also rose above $1.2 billion during the advance, reflecting stronger market participation than Zcash had recorded before the breakout.

ZEC technical indicators remain bullish

The daily chart shows ZEC trading well above all four major moving averages. The 20-day simple moving average stands at $883.74, followed by the 50-day SMA at $650.98 and the 100-day SMA at $560.52.

The 200-day SMA is much lower at $458.79. ZEC is therefore trading roughly 151% above its long-term average, confirming the scale of the advance but also showing how far the price has moved from its broader trend line.

Momentum remains positive on the daily Moving Average Convergence Divergence indicator. The MACD line is at 140.71, above the signal line at 112.36, while the histogram remains positive at 28.35.

The positive configuration indicates that buyers still control the broader trend. However, the declining histogram bars following the price peak suggest that bullish momentum is beginning to cool. A continued decline in the histogram would raise the risk of a longer consolidation even if the broader uptrend remains intact.

On the 4-hour chart, the Supertrend indicator provides immediate support at $1,076.51. ZEC has remained above that level throughout the latest pullback, while the Bull Bear Power reading of 19.98 remains positive.

A close below the Supertrend would weaken the short-term structure and could expose the psychological $1,000 level. The former breakout zone near $875–$888 would become the deeper support area if selling accelerates.

Liquidation map points to resistance near $1,180

CoinGlass’s 24-hour ZEC liquidation heatmap shows the largest nearby concentration of leveraged positions around $1,178–$1,180. Another group of liquidation levels appears between $1,195 and $1,205.

Price often moves toward areas containing concentrated leveraged positions because forced liquidations can add volume once those levels are reached. A break above $1,180 could therefore trigger another push toward $1,200 and the recent high near $1,249.

Additional liquidity sits above $1,230, but ZEC would first need to overcome the selling pressure that emerged during its initial retreat from the peak.

On the downside, the heatmap shows concentrations near $1,110 and across the $1,080–$1,100 region. Losing $1,140 could pull the price toward those levels, with the 4-hour Supertrend at $1,076 providing the next technical test.

Traders should also watch leverage on both sides of the market. The earlier short squeeze helped drive the rally, but a heavily leveraged long market could produce the opposite effect if ZEC breaks below nearby support.

Zcash bulls target $1,500 after pennant breakout

Crypto analyst Team LAMBO Charts described ZEC’s longer-term formation as a bullish pennant and said the token had already surpassed the pattern’s initial $1,000 target.

The analyst identified $1,500 as the next upside objective while arguing that bulls remain in control as long as the breakout holds. From the Sep. 8 price near $1,150, reaching that target would require an advance of approximately 30%.

Before testing $1,500, ZEC must reclaim $1,200 and close above the Sep. 6 peak at $1,249. A sustained breakout beyond that high would leave limited recent price history to act as resistance, although profit-taking could increase as the token approaches the analyst’s target.

The bearish scenario begins with a 4-hour close below $1,076. Such a move would weaken the post-breakout structure and place $1,000 back in focus. A deeper correction toward the rising 20-day SMA near $884 would erase a larger portion of the rally but would still leave ZEC above its medium- and long-term moving averages.

For US traders, Federal Reserve expectations remain a possible source of volatility across speculative assets. Zcash has recently outperformed the broader crypto market, but shifts in rate expectations could still affect leverage and demand as traders assess the next US monetary-policy decision.

The CLARITY Act has moved closer to defeat ahead of its Sept. 15 Senate vote as lawmakers remain divided over presidential ethics rules and stablecoin rewards.

CLARITY Act ethics talks remain stalled

Semafor reported on Sept. 8 that Republican senators expect the crypto market structure bill to fail when the chamber returns, citing little progress on an ethics provision sought by Democrats.

The proposed restriction would address whether a sitting president and immediate family members could profit from crypto businesses while federal policy affecting the industry is being written. According to two Democratic aides cited by Semafor, negotiators have made little movement on the demand.

Sen. Mike Rounds, R-S.D., offered a brief assessment of the talks, saying the situation “does not look good right now.”

Sen. Thom Tillis, R-N.C., who has participated in bipartisan negotiations over the legislation, tied its survival directly to the White House’s willingness to compromise.

“If there’s no interest in the White House in trying to bridge the gap on the ethics language, it is going to fail,” Tillis said.

At the White House, an administration spokesperson told Semafor that Trump remained “unequivocal” in calling on Congress to pass the bill so the United States could compete with other countries in digital-asset development.

The spokesperson also said the administration had worked with Congress and accepted what it considered “the most comprehensive and wide-ranging ethics provision in history.” Democrats have disputed that description, arguing that the language does not sufficiently cover businesses controlled by a president’s relatives.

Questions about Trump’s crypto ties have followed the legislation through Congress. In August, crypto.news covered renewed ethics demands after Public Citizen called for the bill to require a sitting president and immediate family members to divest from crypto ventures.

Trump and members of his family have been linked to several digital-asset projects, including World Liberty Financial and the Official Trump meme coin. Public Citizen argued that federal crypto policy could not be separated from the president’s private financial interests, adding another source of pressure on senators seeking Democratic votes.

Sept. 15 vote requires bipartisan support

Senate Majority Leader John Thune filed cloture on the motion to proceed before lawmakers left Washington for their August recess. Under the scheduled Senate test, the motion will ripen at 2:15 p.m. ET on Sept. 15, one day after the chamber returns for regular business.

The vote will not decide final passage. Instead, senators will determine whether to open debate on the CLARITY Act, with supporters needing 60 votes to advance the measure.

Republicans hold 53 Senate seats, meaning they would need support from at least seven Democrats or independents even if every Republican backed the motion. Opposition within the Republican conference could raise the number of cross-party votes required.

Senators Josh Hawley of Missouri and Rand Paul of Kentucky have been identified as possible Republican opponents. Hawley has raised concerns about provisions governing stablecoin rewards, while community banks have warned that interest-like payments on stablecoins could draw deposits away from insured lenders.

Some Republican senators have sought additional protections for banks before agreeing to support the bill. Democrats, meanwhile, have pressed for state attorneys general to retain enforcement powers because they question whether federal agencies alone would enforce the framework effectively.

Earlier crypto.news coverage identified three unresolved provisions, presidential ethics restrictions, protections for decentralized finance developers, and the treatment of stablecoin rewards, as possible barriers to reaching 60 votes.

A successful cloture vote would allow senators to debate the legislation and offer amendments. Final passage would generally require a simple majority, but any Senate version that differs from the House-approved text would need further action before it could reach the president.

The House passed its version of the Digital Asset Market Clarity Act in July 2025 by a 294-134 vote, including support from 78 Democrats. Senate negotiations have since produced separate proposals addressing the roles of the Securities and Exchange Commission and the Commodity Futures Trading Commission.

For U.S. investors and crypto businesses, the legislation would determine how federal agencies divide oversight of digital assets and trading platforms. The framework would also establish processes for deciding when a crypto asset falls under securities rules and when it qualifies as a digital commodity subject to CFTC authority.

Crypto groups increase pressure before the vote

As support remains uncertain, the Fairshake-linked Cedar Innovation Foundation has announced three national advertisements backing the CLARITY Act ahead of the Senate vote.

The campaign seeks to build public and political support during the final week before senators return. Fairshake and other crypto-aligned political groups have spent heavily in congressional races, giving the industry another way to pressure lawmakers if the bill fails.

Semafor reported that defeat could prompt crypto groups to direct additional funds toward competitive House and Senate races. Sen. Roger Marshall, R-Kan., questioned whether the measure carried much weight among voters in his state.

“There’s nothing I can do with the crypto bill,” Marshall said. “Haven’t heard a peep about it. Nobody back home is asking about it.”

Prediction-market traders have also reduced their expectations for passage. Polymarket odds on the CLARITY Act becoming law in 2026 have fallen from earlier highs as the Sept. 15 vote approaches and the available congressional calendar narrows.

A prediction-market price represents traders’ positions rather than an official forecast, and it can change as negotiations continue or senators announce their votes. Recent readings have nevertheless placed passage well below an even chance.

House calendar leaves little time for final passage

Even if the Senate clears cloture, lawmakers will have limited time to debate amendments, pass the bill, and resolve any differences with the House version.

The Senate will have about 15 session days before election campaigning takes priority ahead of the November midterms. Leadership would need to manage debate while Congress also faces other deadlines competing for floor time.

House leaders have canceled sessions during the final two weeks of September and plan to begin the chamber’s midterm recess by Sept. 17. The schedule leaves little room for representatives to consider Senate changes during the same month.

If senators amend the legislation, the House would need to approve the revised text or the two chambers would have to reconcile their separate versions. The Constitution requires both chambers to pass identical language before a bill can be sent to the president.

Meanwhile, the SEC has continued work on crypto rules without waiting for Congress. In an Aug. 18 statement, SEC Chair Paul Atkins said legislation remained necessary to establish durable rules and prevent a future regulator from easily reversing the agency’s current approach.

The CFTC has also been examining how it can use its existing authority while lawmakers debate an expanded federal framework. Its current powers do not provide the complete spot-market oversight contemplated by the CLARITY Act, which would give the agency a larger role in supervising digital commodities and related intermediaries.

With 38 active cases across 21 states, conflicting federal rulings over Kalshi have raised the risk that U.S. prediction-market access will fragment by location and trading venue, Kalshinomics co-founder Aaron Courtney has told crypto.news.

Courtney, who co-founded prediction-market analytics platform Kalshinomics, said the legal system is dividing access faster than trading data shows any separation in prices or liquidity.

“The legal system is already moving in that direction faster than the price data,” Courtney said in comments shared with crypto.news.

New Jersey filed a petition for a writ of certiorari on Sep. 2, asking the U.S. Supreme Court to review a Third Circuit decision that favored Kalshi. The petition came four days after the Ninth Circuit reached a different conclusion in the company’s Nevada case.

Kalshi rulings have produced conflicting state rules

As previously reported by crypto.news, New Jersey wants the Supreme Court to decide whether the Commodity Exchange Act prevents states from applying sports-gambling laws to contracts traded on a Commodity Futures Trading Commission-registered market.

Kalshi operates a CFTC-regulated designated contract market and argues that its event contracts fall under federal derivatives law. New Jersey considers its sports products wagers that remain subject to state licensing, age limits, and consumer-protection rules.

In April, a divided Third Circuit panel upheld a preliminary injunction that stopped New Jersey from enforcing its gambling laws against Kalshi’s sports contracts. The panel found that Kalshi had shown a reasonable chance of succeeding on its claim that the contracts qualify as swaps under the Commodity Exchange Act.

The decision did not settle the underlying lawsuit. It assessed Kalshi’s likelihood of success while preserving the injunction during litigation.

On Aug. 28, however, the Ninth Circuit rejected Kalshi at the same preliminary stage. Its unanimous panel found that the company’s sports contracts were likely bets rather than swaps, allowing Nevada regulators to enforce state gaming rules while the case continues.

“The CFTC is not a national gambling regulator,” Circuit Judge Ryan Nelson wrote in the Ninth Circuit opinion.

New Jersey’s petition points to the opposing appellate decisions as a reason for Supreme Court review. The filing itself does not mean the justices have agreed to hear the case, and Kalshi will have an opportunity to respond before the court decides whether to accept it.

Courtney said the unresolved divide could leave traders with different products depending on their home state and the federal circuit covering it.

“Until there is a uniform answer, prediction-market access could increasingly depend on which state and federal circuit a trader happens to live in.”

Prediction-market litigation now covers 21 states

According to Casino.org’s Prediction Market Litigation Tracker, 38 active cases are pending across 21 states, while exchanges have received cease-and-desist letters in at least 10 jurisdictions.

The tracker lists New York, Minnesota, Nevada, and Arizona among the states mounting the strongest challenges. Regulators generally argue that sports event contracts operate as unlicensed gambling products, while exchanges rely on federal registration and the CFTC’s authority over designated contract markets.

Court disputes also involve tribal gaming rights, state taxes, and local enforcement powers. Casino.org identifies New York, New Jersey, Minnesota, and California as several of the main venues for litigation.

Separate state orders are already creating different access rules. A Michigan court ordered Kalshi to keep sports contracts unavailable to residents under a Sep. 1 preliminary injunction. The Michigan geofencing requirements carry possible fines of $500,000 for each day the court finds Kalshi out of compliance.

Washington has imposed restrictions covering sports, elections, politics, entertainment, culture, technology, and science contracts. Commodities, climate, economics, and financial markets remain available to users in the state.

The Washington court order required Kalshi to introduce initial geofencing by Aug. 19 and a system using several location sources by Sep. 2. Kalshi maintains that federal law prevents states from regulating contracts offered on its CFTC-registered exchange.

Washington data shows no clear liquidity shock

Because Kalshi’s public application programming interface does not identify each trader’s location, Courtney said outside researchers cannot directly calculate Washington-only volume. He instead used Seattle-linked contracts as proxies for local participation.

The analysis compared the 48 days before the initial Aug. 19 geofence with the following 18 days. Courtney examined Seattle Mariners game contracts against contracts involving the other 29 Major League Baseball teams, along with Seattle’s daily temperature markets against 19 other U.S. cities.

Mariners’ contract volume performed 2.8% better relative to the rest of MLB after the cutoff, placing Seattle near the league’s midpoint. Seattle weather volume declined by 17.7% compared with the other cities.

Courtney said the weather decline remained within normal variation because Philadelphia and Phoenix each fell by more than 30% during the same period without a similar geofence. Median MLB volume per game also dropped 29.6% across the league.

“My takeaway is that any Washington effect is currently smaller than the ordinary seasonal and cross-market noise visible in Kalshi’s public data. That isn’t the same as saying the impact was zero.”

Public data also cannot show whether affected Washington users stopped trading, reduced their activity, or moved to another platform. Seattle weather contracts, which remain available in the state, did not record an increase after Kalshi removed sports and political markets.

Courtney said the evidence did not support a one-for-one move into permitted categories. In his view, sports traders may not consider inflation, finance, or climate contracts suitable replacements for Seahawks game markets.

Washington presents another complication because the state agreed in August to refrain temporarily from enforcement against OG while related appeals proceed, Courtney said. Formerly known as Nadex and operated by Crypto.com, OG also uses a CFTC-designated contract market.

The arrangement offers a possible alternative for displaced traders, although Courtney said account-level information from Kalshi and competing platforms would be needed to measure where their activity went.

Local Kalshi markets face the highest liquidity risk

For heavily traded national contracts, Courtney said excluding Washington alone is unlikely to cause a major disruption. The state accounts for about 2.3% of the U.S. population, while professional market makers and arbitrage traders support many national markets.

Trader quality may matter more than the raw number of excluded accounts, according to Courtney. Removing one active market maker or well-informed participant can affect liquidity and price discovery more than losing several occasional retail traders.

Local markets appear more exposed. In a Sep. 7 snapshot, Courtney found that two Kalshi markets covering Washington Supreme Court races had spreads of about 20 cents, with only one contract traded between their quoted prices. Major MLB and National Football League game markets generally showed spreads of around 1 to 1.5 cents.

According to Courtney, state restrictions can remove residents who have the strongest reason to follow local races and events. Thin local markets may then experience larger spreads, shallower order books, and less dependable market-implied probabilities.

Access restrictions do not yet appear to have separated prices across the largest venues. Courtney compared eight MLB moneyline contracts available on Kalshi and Polymarket on Sep. 7. Five carried identical prices to the cent, while the other three differed by one tick, producing a mean absolute price difference of 0.38 cents.

Courtney said evidence of true fragmentation would include persistent price gaps of several cents between equivalent contracts after accounting for fees and minimum price increments. He would also monitor bid-ask spreads, order-book depth, slippage, active-trader counts, market-maker concentration, and volume by state and exchange.

CoinCorner has launched a Bitcoin custody service for UK customers that charges a 1.5% annual fee and uses keys held separately by CoinCorner and AnchorWatch.

CoinCorner said its new Vault uses multi-signature technology to divide control of customers’ Bitcoin between two companies operating in different jurisdictions. CoinCorner holds one key, while insurance and custody provider AnchorWatch holds the other.

Neither company can independently approve a transfer from the Vault, according to CoinCorner’s support documents. Requiring multiple keys removes the single point of control found in a conventional custodial wallet, where one company can authorize transactions on its own.

Bitcoin held through the service is insured under a policy underwritten through the Lloyd’s of London market. CoinCorner said the cover applies to losses caused by lost keys and unauthorized access, although specific policy conditions and exclusions have not been published on the product page.

Customers can also set their own identity checks, which must be completed before a transaction can proceed. The available controls allow account holders to add verification steps that match their security needs, with CoinCorner’s support team handling the setup.

CoinCorner Vault charges a 1.5% annual fee

Vault costs 1.5% per year, with CoinCorner calculating and billing the fee monthly. The company charges customers on the first day of each month based on the amount of Bitcoin recorded in their Vault at that time.

No long-term commitment is required, and users can move Bitcoin into or out of the product. Withdrawals return funds to a customer’s standard CoinCorner Bitcoin balance, which the company describes as an instant process.

Deposits follow a different monthly schedule. According to CoinCorner’s Vault guidance, Bitcoin added after the first day of a calendar month does not enter the recorded Vault balance until the following month. The company says any Bitcoin remaining within Vault after a withdrawal continues to be insured.

CoinCorner also says it does not lend out or otherwise use Bitcoin placed in the service. The product therefore differs from interest-bearing crypto accounts, where a platform may deploy customer assets through loans or other transactions in return for yield.

Vault does not advertise a return on deposited Bitcoin. Customers instead pay for the custody structure, transaction controls, and insurance attached to assets held within the product.

Multi-signature custody splits control between two firms

Multi-signature wallets require more than one private key to approve a Bitcoin transaction. Under CoinCorner’s setup, the relevant keys are held by independent entities rather than stored by a single platform.

AnchorWatch provides the second part of that arrangement through Trident, its Bitcoin custody infrastructure. The AnchorWatch platform uses Bitcoin scripts and time locks to apply security, recovery, and governance rules at the protocol level.

Time locks can make an alternative method of moving funds available after a specified period when a key is lost or a participant becomes unavailable. AnchorWatch says the design allows recovery conditions to be built into a vault without giving one party immediate control over the Bitcoin.

The US company is also a Lloyd’s coverholder, which allows it to arrange policies backed by underwriting capacity in the Lloyd’s market. AnchorWatch says its other custody products can obtain as much as $100 million of cover per vault, while institutional customers may seek limits of up to $500 million. CoinCorner has not disclosed the limit attached to its UK Vault product, so figures advertised for AnchorWatch’s other services should not be treated as the coverage available to every CoinCorner customer.

AnchorWatch separately offers a three-institution custody configuration involving AnchorWatch, BitGo, and CoinCorner. Its website describes that product as a two-of-three wallet, meaning two institutions must sign a transaction. CoinCorner’s UK-facing documents describe Vault as a two-entity service in which CoinCorner holds one key and AnchorWatch holds the other.

Insurance does not provide FSCS protection

The private insurance attached to Vault is separate from the protection provided through the UK’s Financial Services Compensation Scheme.

CoinCorner states in its legal notice that investments in cryptoassets through its platform are not regulated by the Financial Conduct Authority. Customers also cannot take complaints about the crypto service to the Financial Ombudsman Service, while their Bitcoin is not eligible for FSCS protection.

The distinction matters because private policies cover named events under agreed terms and exclusions. CoinCorner identifies lost keys and unauthorized access as covered events, but its public Vault material does not say that the policy protects customers from a fall in Bitcoin’s price, insolvency, or every possible operational loss.

CoinCorner Ltd is based in the Isle of Man and is registered with the Isle of Man Financial Services Authority under the Designated Business Act 2015. The company is also registered with the Isle of Man Office of Fair Trading as a moneylender.

Its electronic money and payment services have a separate structure. CoinCorner acts as a distributor for Mercury Foreign Exchange Limited, an FCA-authorized electronic money company, but the authorization attached to those payment services does not extend FCA protection to CoinCorner’s cryptoasset products.

Founded in 2014, CoinCorner says it serves more than 350,000 users across 15 markets. The company previously entered the UAE market through a 2022 partnership with Dubai-based Seed Group covering Bitcoin trading, storage and payment services.

UK crypto custody faces new FCA rules in 2027

CoinCorner has introduced Vault as the UK prepares to place crypto custody under a full authorization system.

As crypto.news reported in June, the FCA’s new cryptoasset regime is scheduled to take effect on Oct. 25, 2027. The rules will cover custodians, trading platforms, stablecoin issuers, staking providers and other intermediaries.

Firms seeking to conduct regulated crypto activities will have an application window running from Sept. 30, 2026, through Feb. 28, 2027. Existing registrations under the UK’s anti-money laundering rules will not automatically become authorizations under the new Financial Services and Markets Act framework.

The regulator plans to apply requirements covering custody, capital, operational resilience, disclosures, market conduct and consumer protection. Companies may also need to show that they can withstand market stress and maintain financial resources against risks carried on their balance sheets.

In August, US trading platform Robinhood secured FCA registration under the existing anti-money laundering system before the new framework takes effect. More than 50 companies were listed on the FCA’s cryptoasset register at the time, including Kraken, Ripple, BlackRock and BNY.

For American customers, AnchorWatch advertises a separate multi-institution service using a two-of-three arrangement with CoinCorner and US custodian BitGo. Its website says insurance for that configuration is optional for US users, with indicative pricing beginning at $4,000 for every $1 million of coverage and final premiums subject to underwriting review.

StablecoinX has named Christopher Jensen as its new chief executive officer, a move that places the former Franklin Templeton digital asset executive at the helm of the biggest corporate holder of Ethena’s ENA token. The appointment underscores how quickly leadership in publicly traded crypto vehicles is shifting toward personnel with traditional asset-management experience.

Jensen replaces Ted Chen, who led StablecoinX through its public listing in June and will continue as chairman of the company’s board. StablecoinX trades on Nasdaq under the ticker USDE and is closely tied to Ethena’s synthetic dollar product, USDe.

Key takeaways

• StablecoinX appointed Christopher Jensen as CEO, bringing in leadership experience from Franklin Templeton’s digital asset efforts.
• Jensen’s mandate includes oversight of StablecoinX’s large ENA position, which the company says is about 3.03 billion tokens (roughly 20% of supply).
• Ted Chen transitions from CEO to chairman after guiding StablecoinX through its June Nasdaq listing.
• Ethena’s ecosystem developments continue in parallel, including the recent rollout of Ethena Pay.
• ENA has struggled on a year-to-date basis but has rebounded sharply in the past month, according to CoinGecko.

From Franklin Templeton to StablecoinX’s ENA stewardship

Christopher Jensen’s background is rooted in mainstream asset management and early institutional research into blockchain markets. Before joining StablecoinX, he served as a portfolio manager and director of digital asset research at Franklin Templeton, where he helped build the firm’s digital asset group after its launch in 2018.

According to the company, Franklin Templeton’s blockchain venture fund participated in Ethena’s seed round. That connection matters because it suggests Jensen was exposed to Ethena’s development before USDe scaled into one of the better-known synthetic stablecoins in DeFi.

StablecoinX’s corporate role within the Ethena ecosystem is especially relevant because of its concentration in ENA. The company holds approximately 3.03 billion ENA tokens, which it says represents about 20% of the token’s total supply—making it ENA’s largest corporate holder. ENA, as Ethena’s governance token, provides voting rights over protocol changes, meaning StablecoinX is not only an investor in Ethena’s ecosystem but also an influential governance participant.

Leadership change after StablecoinX’s Nasdaq listing

The CEO transition comes as StablecoinX continues operating as a publicly listed entity rather than a private crypto vehicle. Ted Chen, the outgoing CEO, previously led the company through its public listing in June via a reported merger process and will remain chairman of the board.

The arrangement—Jensen taking day-to-day executive control while Chen retains board leadership—often signals continuity in strategy while adjusting operational leadership. For shareholders and token-adjacent investors, the key question is how Jensen’s background in traditional asset management will shape risk controls, governance posture, and the company’s engagement with Ethena’s evolving roadmap.

StablecoinX trades on Nasdaq under the ticker USDE and focuses on the Ethena ecosystem. Its core linkage to Ethena stems from USDe, a synthetic dollar that DefiLlama data ranks as the fifth-largest stablecoin by market size, with nearly $4.4 billion in circulation. (Source: DefiLlama data.)

Ethena’s product push and what it implies for ENA holders

StablecoinX’s CEO appointment arrives roughly a week after Ethena launched Ethena Pay, a self-custodial app designed to let users spend, save, and transfer USDe across 48 countries. Earlier coverage from Cointelegraph described the rollout as expanding real-world utility for the synthetic dollar rather than restricting it to on-chain settlement and DeFi interactions (see this report).

For ENA governance and corporate holders like StablecoinX, broader USDe accessibility can affect expectations around protocol usage—especially if demand for spending and transfer flows increases. While governance token prices are not directly guaranteed by product launches, a sustained increase in end-user adoption can influence how markets interpret the protocol’s growth trajectory and the value of governance rights.

That said, governance tokens typically reflect a wider mix of factors than product announcements alone, including liquidity conditions, broader stablecoin sentiment, and DeFi market cycles. Investors should be cautious about assuming cause-and-effect between a payment app rollout and near-term ENA performance.

ENA market performance: rebound after a weaker start

On the market side, ENA has had a turbulent recent profile. CoinGecko data cited in the source indicates the token remains down about 20% year to date, but has rebounded sharply over the past month—gaining more than 80% and trading around $0.16.

This type of pattern—weak longer-term performance followed by a sharp short-term rally—often reflects shifting liquidity and risk appetite rather than a single fundamental change. The new leadership at StablecoinX will likely be watched by market participants for signs of whether corporate governance and capital allocation around ENA and USDe will become more active as Ethena expands its distribution.

Still, the immediate timeline for how Jensen will influence governance votes, treasury strategy, or engagement with Ethena’s development team is not yet clear. The move itself signals intent to align the company’s executive oversight with people who understand both regulated finance structures and on-chain market mechanics.

What to watch next

Readers should watch how Jensen’s appointment translates into StablecoinX’s governance engagement with ENA, as well as whether Ethena Pay’s rollout leads to measurable increases in USDe usage. The near-term test will be less about headlines and more about whether corporate governance activity and ecosystem adoption move in tandem over the coming weeks.

Dogecoin price held near $0.09 on Sep. 8 after gaining roughly 10% from its Sep. 2 low, while technical and liquidation data pointed to a possible test of $0.092.

Dogecoin price holds its weekly breakout

According to data from crypto.news, Dogecoin (DOGE) price traded near $0.0901 at the time of writing, about 10.3% above its Sep. 2 low of roughly $0.0817. The meme coin briefly approached $0.092 during the recovery before entering a narrow consolidation around $0.089–$0.091.

The latest move extended a broader rebound that began after DOGE established a base close to $0.069 in August. A sharp rally later that month carried the token above $0.09, although sellers prevented it from sustaining a move beyond $0.095.

The daily chart shows that buyers defended the $0.080–$0.082 region during the pullback at the beginning of September. DOGE then formed a higher low and recovered above $0.09, leaving its short-term structure tilted upward.

Price action on the 4-hour chart is less decisive. Dogecoin has traded sideways since Sep. 5, with repeated attempts to break above $0.091–$0.092 meeting selling pressure. The narrow range suggests that traders are waiting for enough momentum to challenge the next liquidity zone.

The weekly recovery is partly due to short covering after traders built bearish positions around the early-September low. However, the liquidation heatmap alone does not confirm how much of the rally resulted from forced short closures.

DOGE trades above its key daily averages

Dogecoin’s daily chart has improved after the latest rebound. DOGE trades above its 20-day simple moving average at $0.08713 and its 200-day SMA at $0.08839.

The token has also moved above its 50-day and 100-day averages, shown near $0.07720 and $0.07840, respectively. Holding above the 200-day average would help preserve the recovery, while a daily close below it could weaken the current setup.

The moving averages still reflect a mixed longer-term structure. The 200-day SMA remains above the shorter 20-day average, while both the 50-day and 100-day averages remain well below the market price. DOGE therefore has stronger short-term momentum but has yet to establish a fully aligned bullish trend.

Momentum on the daily chart remains positive but has slowed. The moving average convergence divergence line stood near 0.00336, slightly above its signal line at approximately 0.00321. The histogram was positive at 0.00015, showing that bullish momentum remained in place by a narrow margin.

A widening gap between the MACD and signal lines would support another advance. A bearish crossover, by contrast, would increase the risk of DOGE returning to its moving-average support cluster.

Liquidation map puts $0.092 in focus

CoinGlass’ three-day liquidation heatmap shows the strongest nearby concentration of leveraged positions between approximately $0.092 and $0.0926. Additional liquidity appears around $0.094 and near the top of the chart at $0.0965.

Liquidation clusters can attract price because leveraged positions may be forced to close as the market approaches their trigger levels. They do not guarantee that DOGE will reach those prices, and traders can reposition before a cluster is tested.

A clean move through $0.0926 would expose the $0.094 area, where Dogecoin recorded repeated rejections in late August. Clearing that level could allow bulls to target $0.0965 and the psychological $0.10 mark.

The heatmap also shows liquidity below the market around $0.088, followed by a broader band near $0.087. A decline into those zones could trigger leveraged long liquidations and add to selling pressure.

The placement of liquidity on both sides of the current price leaves DOGE vulnerable to short-term swings. The denser and brighter cluster above $0.092 nevertheless makes that region the most visible immediate target if buyers regain control.

Dogecoin support rests between $0.087 and $0.0884

The first important support is the $0.0884 area, where the 200-day moving average meets a recent breakout level. The 20-day SMA near $0.0871 provides the next layer of support.

On the 4-hour chart, the Supertrend remains bullish, with its support line near $0.08467. Dogecoin has stayed above the indicator since rebounding from its early-September low, but a close below $0.0847 would invalidate much of the latest short-term recovery.

Buying pressure does not yet confirm a strong breakout. The 4-hour Chaikin Money Flow reading stood at minus 0.05, indicating that capital flow was slightly negative despite DOGE holding near $0.09. A move above zero would provide stronger evidence that buyers are supporting the advance.

The bullish scenario requires DOGE to hold above $0.0884 and break the $0.092–$0.0926 resistance band. Such a move would bring $0.094, $0.0965, and eventually $0.10 into view.

Failure to hold the daily moving-average cluster would shift attention toward $0.0871 and $0.0847. A deeper decline below the Supertrend support could expose the recent swing-low region between $0.080 and $0.082.

US macro pressure could limit the DOGE rebound

The shifting US interest-rate expectations are a risk for Dogecoin and other speculative assets. Higher Treasury yields or stronger expectations for tighter Federal Reserve policy can reduce demand for non-yielding assets, although the effect varies across trading sessions.

Dogecoin also remains sensitive to Bitcoin’s direction because broader crypto sell-offs often weigh more heavily on high-volatility altcoins. Continued weakness in Bitcoin could make it harder for DOGE to clear the liquidation cluster above $0.092.

The charts leave Dogecoin at a technical decision point. DOGE has reclaimed its main daily moving averages, but weak 4-hour capital flows and concentrated liquidity on both sides of the market mean a confirmed break above $0.0926 is still needed to extend the recovery.

A range-proof cache bug in the Elements codebase let an unknown actor mint unbacked L-BTC, drain 95% of the federation reserve through SideSwap, then negotiate its return on-chain via OP_RETURN messages. The network remains frozen, 598.5 BTC sits in the attacker’s wallet, and the entire federated sidechain model faces the hardest questions it has ever had to answer.

Sunday afternoons are not supposed to feel like bank runs. Yet on Sept. 6, 2026, anyone watching the Liquid Network federation wallet saw something that looked a lot like one: 3,996 BTC leaving in a single peg-out transaction at 14:28 UTC, collapsing the reserve from 4,205 BTC to 202 BTC in less than half a minute. At prevailing prices, that was roughly $320 million. Gone.

What followed over the next 30 hours was one of the strangest episodes in Bitcoin’s history. The person or group behind the drain did not disappear into a mixing service. They wrote “we are whitehats. contact us on chain” in an OP_RETURN field, opening a public negotiation with Blockstream that anyone with a block explorer could read in real time. Nine messages went back and forth. A PGP key was verified. Bridge nodes were patched. And then 3,400 BTC came back, leaving 598.5 BTC, about $47 million, sitting in an address that nobody controls except the attacker.

The mechanics of what happened are technical. The implications are not. Liquid is the oldest Bitcoin sidechain, operated by a federation of 15 functionaries running tamper-proof hardware security modules in an 11-of-15 multisig arrangement. It has processed billions in volume for exchanges, traders, and tokenized asset issuers since its launch in 2018. Now its reserves are short by $47 million, its reputation is in intensive care, and the broader question of whether federated sidechains can be trusted with real money is louder than it has been at any point in the past eight years.

How the range-proof cache bug worked

To understand the exploit, you need to understand how Liquid hides transaction amounts. Liquid uses confidential transactions, a cryptographic scheme where the value in each output is hidden behind a Pedersen commitment. Range proofs verify that the hidden amount falls within an allowed range without revealing what the amount actually is. This is computationally expensive, so Elements, the Bitcoin Core fork that powers Liquid, caches successful verification results for reuse.

The problem was in how the cache stored those results. Before the patch, the cache key was derived from the proof bytes and hidden amount alone. Asset type and scriptPubKey context were not included. That meant a previously verified proof could be replayed in a context where it should not have been valid.

The attacker exploited this by planting 68 identical range proofs across 14 hours between Liquid blocks 4,049,384 and 4,050,246, spending 41 satoshis per transaction. Each carried an OP_RETURN output with L-BTC written plainly but the amount hidden, using a commitment to zero with the simplest possible blinding key. Once those proofs were cached, the attacker constructed an invalid output that matched the cache key of a previously valid check. Federation nodes retrieved the cached result and skipped the verification that should have rejected the inflationary output.

At Liquid block 4,050,336, the attacker created approximately 3,996 L-BTC out of nothing. Those tokens looked valid to every federation functionary running the vulnerable code. The attacker sent them to SideSwap’s peg-out service, which burned the L-BTC and requested payment from the federation. The federation obliged, releasing 3,996.0183 BTC to the attacker’s Bitcoin address.

The fix, which binds the cache verification to both asset type and scriptPubKey, had been committed to the Elements master branch on Aug. 3 and merged on Sept. 2. But it had never appeared in a tagged release. The federation nodes were running version 23.3.3, dated April 13, which did not include the patch. Mononaut, the mempool.space developer, noted that federation functionaries accepted the exploit transactions, approved the withdrawals, and continued building blocks, while other nodes running different code rejected the invalid transactions entirely.

DeFi has lost more than $1.3 billion to hacks in 2026, with compromised private keys overtaking smart contract bugs as the leading attack vector for the first time on record. The Liquid exploit does not fit neatly into either category. No keys were stolen. No smart contract was drained. A caching optimization in transaction verification logic left a gap wide enough for someone to mint $320 million.

The 23 minutes that emptied the vault

The attacker was not reckless, and the on-chain record shows a methodical dry-run sequence that preceded the main event by two full days.

On Sept. 4, two small peg-in transactions totaling 2.15 BTC entered Liquid. Two days later, on the morning of Sept. 6, three dry-run peg-outs moved 0.95, 1.71, and 0.55 BTC through SideSwap between 11:30 and 13:16 UTC. Each one completed without issue. The peg-out mechanism worked. The federation signed. Real BTC arrived on the other side.

At 13:53 UTC, the main event: the minting transaction created roughly 4,000 unbacked L-BTC. At 14:28:56 UTC, the federation processed the peg-out, releasing 3,996.0183 BTC. SideSwap forwarded 3,995.99999857 BTC to the attacker’s final address in the same block. The SideSwap fee of 0.1%, roughly 3.996 BTC, plus the three dry-run payouts of 3.21 BTC combined, were the only friction in the entire operation.

From mint to peg-out to receipt, the elapsed time was approximately 35 minutes. From the moment the federation signed the peg-out to the moment the Bitcoin reached the attacker, it was a single block.

The reserve cliff is visible on any blockchain analytics dashboard. Liquid’s federation wallet held 4,205.29 BTC at 14:27 UTC. One minute later, it held 202.63 BTC. It is the most dramatic single-transaction reserve drain in the history of Bitcoin sidechains.

On-chain negotiation: nine messages in OP_RETURN

What happened next turned a catastrophic exploit into something closer to a hostage negotiation conducted entirely in public.

At 18:30 UTC on Sept. 6, roughly four hours after the drain, the attacker embedded a message in a Bitcoin transaction: “we are whitehats. contact us on chain.” The choice of communication channel was deliberate. OP_RETURN messages are permanent, public, and verifiable. Neither side can fake the origin of a message sent from an address they control.

Blockstream responded at 19:31 UTC with a straightforward request: “Please contact [email protected].” The attacker ignored the email offer.

At 03:30 UTC on Sept. 7, after Liquid had halted block production at 04:49 UTC, the attacker sent a longer message: “Please fix the bug first. The chain is under risk at latest commit right now. Make sure every node is patched. Then we will transfer the money back safely after confirming the fix.”

This was not a ransom demand. It was a security disclosure with $320 million in collateral. The attacker wanted proof that the vulnerability was closed before returning funds that could theoretically be re-exploited by someone else.

Blockstream spent the next several hours patching bridge nodes across the federation. At 09:04 UTC on Sept. 7, Blockstream sent a PGP-signed message: “Bridge nodes are patched, safe to return the funds.” The signature verified against the security key ending 6844 A2D6 published at blockstream.com/pgp.txt. Seven total verified Blockstream messages were sent from fresh addresses over the course of the negotiation.

At 16:09 UTC on Sept. 7, the return transaction landed: 3,400 BTC back to the federation address. The remaining 598.5 BTC stayed in the attacker’s wallet. The final OP_RETURN message from the attacker, sent at 21:03 UTC, contained a single emoticon: “:(“

That frowny face has become one of the most analyzed two characters in Bitcoin history. Was it regret at having to keep any amount at all? Disappointment that the bug existed in the first place? A sardonic comment on the state of sidechain security? Nobody knows, and the attacker has not communicated since.

The $47 million question: bounty or theft

The 598.5 BTC the attacker retained is worth approximately $47 million. There was no formal bug bounty program covering this vulnerability. There was no contract, no prior agreement, and no legal framework governing the situation.

Liquid’s attackers offered to return most of the 4,000 BTC, and they did. But “most” is doing heavy lifting in that sentence. Keeping 15% of a $320 million exploit without any prior agreement is not what most security researchers would call standard white-hat behavior.

Charles Guillemet, CTO of Ledger, was among the first prominent voices to push back on the white-hat framing. His argument was direct: genuine white hats disclose a flaw before moving hundreds of millions in collateral, not after. Draining 95% of a network’s reserves and then demanding a patch before returning anything resembles extortion more than it resembles security research.

The counterargument, and it is not a weak one, runs like this: the attacker found a live vulnerability that could have been exploited by a malicious actor at any time. By draining the funds and holding them, they prevented a black-hat from doing the same thing with no intention of returning anything. The 598.5 BTC is compensation for a service rendered, not a ransom paid under duress.

Both positions have precedent. The 2022 Wormhole exploit saw the attacker keep $320 million with zero returned. The 2023 Euler Finance hack resulted in a full return after on-chain negotiation. The Ronin bridge exploit in 2022 saw state-backed attackers from North Korea’s Lazarus Group take $624 million with no negotiation at all. Against that backdrop, getting 85% back within 30 hours looks like one of the better outcomes in the history of crypto exploits.

The legal question remains open. Unauthorized access statutes in most jurisdictions do not include a “good intentions” exception. Taking funds without authorization and then returning most of them may satisfy the definition of theft regardless of what the attacker writes in an OP_RETURN field. Whether any law enforcement agency will pursue the case, given that the majority of funds were returned, is a different matter entirely.

Why federation nodes ran unpatched code

This is the part of the story that should concern anyone who uses a federated system.

The fix for the range-proof cache bug was committed to the Elements repository on Aug. 3, 2026. It was merged into the main branch on Sept. 2. Four days later, the exploit happened. The federation nodes were running version 23.3.3, released on April 13, which predated the fix by nearly five months.

The gap between “fix merged” and “fix deployed to production” is a familiar problem in software engineering. It is also a problem that is supposed to be mitigated by the entire structure of a federated sidechain. Liquid’s 15 functionaries operate specialized hardware security modules. They run tamper-proof servers. They manage an 11-of-15 multisig wallet designed to tolerate up to four compromised or offline signers. The security model assumes that the federation is competent, well-resourced, and running current software.

Running unreleased development code is one kind of risk. Running code that is five months behind a critical security fix is another. Neither inspires confidence.

Liquid Network recovered 3,400 BTC after the bridge exploit, but the recovery came from the attacker’s goodwill, not from any federation safeguard. If the attacker had been a Lazarus Group operator, the 3,996 BTC would have gone through a mixer within hours and the Liquid Network would have been insolvent with no path to recovery.

The question that Blockstream has not yet answered publicly is why a patch that had been merged for four days and committed for over a month was not deployed to federation nodes. Sidechain security is only as strong as the weakest link in its operational chain. For Liquid, that weakest link turned out to be a software update that sat in a repository while the vulnerability it fixed sat in production.

The DAO parallel: when code breaks trust

The comparisons to the 2016 DAO hack started within hours of the Liquid drain, and they are worth taking seriously.

In June 2016, an attacker exploited a reentrancy bug in the DAO smart contract to drain 3.6 million ETH, worth roughly $60 million at the time. The Ethereum community faced a choice: accept the exploit as a valid outcome of the code or hard fork the network to reverse the transaction and return the funds. Ethereum chose the fork. Ethereum Classic, the unforked chain, survived as a philosophical statement that code is law and exploits are just the market correcting for bad code.

The Liquid situation rhymes but does not repeat. Bitcoin’s base layer was never at risk. The exploit happened entirely within the Liquid sidechain, and the peg-out mechanism that released real BTC was functioning exactly as designed. It released funds because the federation nodes told it the request was valid. The federation nodes said the request was valid because their verification cache had been poisoned by a bug that should have been patched.

There is no fork debate here because there is nothing to fork. Liquid is a federated sidechain, not a proof-of-work chain with independent miners. Blockstream can patch the code, restart the bridge nodes, and resume operations. The 598.5 BTC that the attacker kept is gone. It left the Liquid system through a legitimate peg-out and now exists on the Bitcoin base layer, where it is subject to the same rules as any other Bitcoin. No amount of federation governance can claw it back.

But the DAO parallel holds in a deeper sense. Both incidents forced their respective communities to confront the gap between the security model they believed they had and the security model they actually had. Ethereum believed smart contracts were trustless. Liquid’s users believed a federation of 15 functionaries running hardware security modules was safe enough. Both assumptions died on contact with a sufficiently motivated attacker.

The opposing case: federated sidechains still work

It is worth making the bull case for Liquid and federated sidechains at full strength, because the bearish narrative writes itself and the truth is more complicated.

First, the peg-out worked exactly as designed. The federation signed a transaction that looked valid according to the rules it was running. The bug was in the verification logic, not in the signing logic, the key management, or the HSM infrastructure. Blockstream’s core security architecture, the 11-of-15 multisig with tamper-proof hardware, was never breached.

Second, the attacker returned 85% of the funds within 30 hours. Compare that to the Bybit hack in February 2025, where Lazarus Group stole $1.4 billion and returned nothing. Compare it to the Ronin bridge, where $624 million vanished into North Korean laundering networks. Compare it to the Coldcard hardware wallet exploit that drained $130 million in July 2026 with no possibility of recovery. Liquid’s outcome, while painful, is among the best that any exploited protocol has achieved.

Third, the vulnerability was a software bug, not a design flaw. Range-proof caching is an optimization, and the fix is straightforward: include asset type and scriptPubKey in the cache key. The patch already exists. Once deployed, this specific attack vector closes permanently.

Fourth, other assets on Liquid, including USDT, DePix, and tokenized real-world assets, were unaffected. The exploit targeted the BTC peg-out mechanism specifically. Users holding L-USDT or other Liquid-issued tokens did not lose funds.

The counterargument to all of this is simple: “It worked as designed” is cold comfort when the design allowed $320 million to walk out the door. A system that depends on 15 organizations keeping their software up to date has 15 potential points of failure. And the fact that recovery depended on the attacker’s goodwill, not on any protocol safeguard, is not a feature of the security model. It is the absence of one.

What this means for every federated bridge

The Liquid exploit lands at a moment when the Bitcoin sidechain and Layer 2 ecosystem is more crowded and more ambitious than it has ever been.

Stacks, which upgraded to the Nakamoto release in late 2025, uses a different security model tied to Bitcoin finality. The Lightning Network operates as a true Layer 2 with channel-based security that does not depend on a federation. Fedimint, the federated e-cash protocol, uses a similar federation structure to Liquid but for custodial Bitcoin custody rather than a full sidechain. RSK, another federated sidechain, shares many of Liquid’s architectural assumptions.

For every project that uses a federation, the Liquid exploit is a wake-up call. The question is not whether federation members can be trusted with private keys. The question is whether federation members can be trusted to run current software, respond to security disclosures in time, and maintain operational discipline across 15 independent organizations with different priorities, different IT teams, and different levels of urgency.

Protocol halts after exploits are becoming routine across the industry. The Liquid freeze is more consequential than most because it affects a Bitcoin-native sidechain that institutional players have used since 2018. If Liquid cannot guarantee that its federation is running patched software, then the trust advantage that a known, regulated federation is supposed to provide over anonymous validators or decentralized bridges collapses.

The broader lesson is one that the DeFi ecosystem has been learning the hard way since 2020: operational security is not a feature you ship once. It is a process you execute every day. Bugs will be found. Patches will be written. The question is whether the patch reaches production before the attacker reaches the peg-out. On Sept. 6, 2026, the answer was no.

What to watch

• Federation node software versions: Whether Blockstream implements mandatory version checks or automated update mechanisms for functionary nodes will signal how seriously the operational gap is being addressed.
• L-BTC depeg recovery: The reserve backing ratio dropped to roughly 86 cents per L-BTC after the return. Watch for how quickly confidence and peg stability return once bridge nodes reopen.
• The 598.5 BTC wallet: On-chain trackers will monitor the attacker’s retained funds for movement. Any attempt to mix or spend will provide forensic data about the attacker’s identity and intentions.
• Legal and regulatory response: Whether any jurisdiction opens a criminal investigation will set precedent for how self-declared white-hat exploits are treated when no formal bounty agreement exists.
• Competing sidechain and L2 adoption: If institutional users migrate volume from Liquid to Lightning, Stacks, or centralized settlement layers in the wake of the exploit, it will be visible in on-chain metrics within weeks.

Disclaimer: This article was published on Sept. 7, 2026, and reflects information available at the time of writing. The situation around the Liquid Network exploit is developing. Readers should verify current status through official Blockstream channels before making any decisions related to Liquid Network assets.