Nu has launched U.S. deposit accounts, credit cards and international transfers through Lead Bank while introducing a stablecoin-based account serving more than 35 countries.

Nu said on Sept. 10 that customers could register immediately for early access to the products. The NYSE-listed financial technology company is entering the U.S. through a partner-bank structure because its own national bank charter remains subject to further regulatory approvals.

The U.S. offering includes an account paying a variable 3.50% annual percentage yield, a debit card and a Mastercard credit card carrying no annual fee. Nu Global, a separate international product, converts customer deposits into USDC or EURC and supports transfers across parts of Europe and Latin America.

Nu enters U.S. banking through Lead Bank

Nu is not currently a bank in the United States. Banking services and the Nu Credit Card are provided by Lead Bank, a member of the Federal Deposit Insurance Corporation, according to disclosures accompanying the launch.

Customer deposits in the Nu Account are held at Lead Bank. Nu says the account pays 3.50% APY on every available dollar, with interest calculated and credited daily. The advertised rate was accurate as of Sept. 10 and may change after an account opens.

Users receive access to savings goals without losing immediate access to their funds. The account supports domestic transfers and international transfers beginning with Brazil, Mexico and Colombia, although Nu says more destinations will follow.

A limited-edition metal debit card forms part of the initial package. Through its Mastercard relationship, Nu is offering a metal World Elite credit card with no annual fee and unlimited 1.5% cashback on purchases.

The company plans to raise the cashback rate to 2% for customers who meet qualifying conditions. Nu has not disclosed the complete eligibility terms or confirmed when the higher rate will become available.

Eligible customers will eventually be able to earn 4.50% APY on savings balances of up to $10,000. To qualify, a customer must hold the Nu Account and credit card, then complete at least three eligible card transactions within the previous 34 days. Balances above $10,000 will continue earning the standard rate, according to the product disclosure.

Nu Global holds balances in USDC and EURC

Nu Global gives customers a digital account for holding, transferring and spending funds across more than 35 countries. Every deposit is converted into either USDC, a dollar-pegged stablecoin, or EURC, a euro-pegged stablecoin.

The company advertises a variable daily yield equivalent to 3.50% APY for USDC balances and 2.20% for EURC. Nu’s announcement does not identify how the yield is generated, which legal entity holds the stablecoins or whether the balances receive deposit insurance.

Stablecoins are digital assets designed to track reference currencies, but they are not the same as insured bank deposits. Nu Global should therefore be distinguished from the U.S. Nu Account provided through Lead Bank.

Customers receive a virtual Mastercard for spending their balances. Nu says the card offers competitive foreign exchange rates without markups, while transfers between supported countries carry no service fee.

The first group of supported markets covers much of the European Union and several Latin American countries. Transfers are available in Argentina, Chile, Costa Rica, El Salvador, Honduras, Paraguay, Peru and Uruguay, according to a market list reported by Folha de S.Paulo.

European coverage includes Germany, France, Italy, Spain, Portugal, Ireland, Switzerland, Sweden and more than 20 other jurisdictions. Integrations involving Nu’s businesses in Brazil, Mexico, Colombia and the U.S. are planned for the coming months.

The product permits customers to hold and trade selected digital assets, including Bitcoin and Ethereum. Nu has not published a complete token list, custody arrangement or fee schedule for those trades in its launch announcement.

In related coverage, 21 financial institutions are preparing a multicurrency stablecoin venture expected to begin issuing tokens in 2027. Separately, U.S. Bank completed a cross-border stablecoin pilot between its North American and European entities using Stellar.

Nu’s U.S. bank charter is not final

Nu applied to form Nubank, N.A. in September 2025. The Office of the Comptroller of the Currency granted conditional approval on Jan. 29, allowing the company to enter the bank-organization phase.

Conditional approval does not authorize Nubank, N.A. to begin independent banking operations. Nu must satisfy the OCC’s conditions and secure required approvals from the Federal Reserve and FDIC.

The company said in January that it needed to capitalize the proposed institution within 12 months and open the bank within 18 months. U.S. chief executive Cristina Junqueira told Reuters that she expects the bank to begin operating in 2027.

A completed charter would allow Nubank, N.A. to offer deposit accounts, credit cards, lending and digital asset custody under a federal banking structure. Until then, Nu’s U.S. customers receive regulated banking products from Lead Bank.

Nu founder and chief executive David Vélez described the launch as the beginning of a “multi-decade journey” outside Latin America. His statement presents the company’s strategy and should not be read as a forecast of future market share.

Junqueira said capturing even a small portion of the U.S. market “will be transformative for our business.” Nu has not published U.S. customer, deposit or revenue targets for the new operation.

U.S. launch follows Nu’s first $1 billion quarter

Nu reported $1.06 billion in net income for the second quarter of 2026, crossing $1 billion for the first time. The result increased 49% from the previous year on a currency-neutral basis and exceeded the $967.2 million Visible Alpha estimate cited by Reuters.

Second-quarter revenue reached $5.88 billion, up 39% and above the cited $5.60 billion forecast. Its risk-adjusted net interest margin rose to 12.4% from 9.9% one year earlier.

The company serves more than 140 million customers across Brazil, Mexico and Colombia, according to its latest announcement. Brazil remains its largest operation, where Nu says it serves more than 60% of the adult population.

In Mexico, the company describes itself as the largest digital bank. Nu says its Colombian business ranks fourth among the country’s financial institutions by deposits, though the claim depends on the company’s selected market classification.

Nu shares gained as much as 1.6% during U.S. trading after the announcement, Reuters reported. The publication identified the move as the market’s initial reaction, not a measure of the U.S. operation’s future financial performance.

Nu Global is already available in selected European and Latin American markets. The company has not provided exact launch dates for its planned integrations with Brazil, Colombia, Mexico and the United States.

A flaw in Brevo’s email login setup allowed an attacker to access client accounts and launch phishing campaigns that targeted subscribers of multiple crypto companies, including Trezor. Brevo’s post-incident write-up says 138 client accounts were involved, with phishing messages sent through infrastructure connected to hardware wallet maker BitBox and crypto portfolio tracking and tax-reporting platform CoinTracking.

The incident matters for users because it highlights how widely used marketing and notification providers can become a bridge for account-based compromise—one that can bypass typical email authentication safeguards and reach audiences that expect legitimate updates.

Key takeaways

• Brevo said an attacker used a login-system issue to gain access to 138 client accounts and send phishing emails from six of them.
• Trezor reported that the initial phishing email was sent to roughly 347,000 newsletter customers, and it disabled the malicious domain within about 20 minutes.
• Trezor, BitBox, and CoinTracking share the same email provider for newsletters, which enabled the attacker to pivot across multiple crypto audiences.
• Brevo said an intended authorization boundary failed, allowing access beyond the organization where invited Brevo users belonged.
• Crypto firms are treating their affected newsletter lists as potentially exposed and possibly reusable for further phishing attempts until more details emerge.

Brevo’s incident report: authorization boundary failure

In a Thursday postmortem, Brevo described how the attacker exploited a vulnerability in its login system to reach other organizations. Brevo said six accounts were used to send phishing emails. It also reported that contacts were exported from 43 accounts, while 93 accounts showed no meaningful activity. The company did not clarify whether those categories overlapped.

According to Brevo’s write-up, the attacker created a Brevo account, enabled single sign-on, and invited legitimate Brevo users into the configuration. Brevo said access should have been confined to a single organization, but the authorization boundary failed—granting the attacker access to every organization the invited users could reach.

Brevo also published its incident details through its status page, including the write-up referenced by affected companies.

Why crypto newsletters looked legitimate

The scope of the phishing effort expanded on earlier warnings from Trezor and BitBox, which had flagged that their shared email provider could be used to deliver convincing messages. Earlier coverage from Cointelegraph noted how the attack was able to pass normal authentication checks and appear genuine to recipients.

That combination—credible branding plus delivery through a familiar provider—makes these campaigns especially dangerous. Users are more likely to trust emails that match the expected tone and format of official newsletters, even when the link or call-to-action is malicious.

Trezor: app request tied to wallet backups

In a separate blog post, Trezor detailed what it said the phishing message contained. The email, titled “Critical Security Alert: STM32 Entropy Vulnerability,” included a link to an app that asked users for their wallet backups.

Trezor said it disabled the domain at the DNS level within 20 minutes. Even so, it reported that roughly 2,500 people accessed the link before the takedown.

A Trezor spokesperson told Cointelegraph that the initial email was sent to 347,000 customers and that all of those newsletter subscribers were later contacted about the risk. The company said its Brevo account stored only opt-in newsletter email addresses and no other customer data.

Until additional information is provided by Brevo, the spokesperson added that Trezor is treating the roughly 347,000 newsletter addresses as known to the attacker and possibly reusable for future phishing.

BitBox and CoinTracking: lists potentially exposed

BitBox said its unauthorized email was sent through Brevo and appeared to reach its full newsletter and tutorial list. In comments relayed to Cointelegraph, a BitBox spokesperson said the Brevo account stored only email addresses and language preferences.

BitBox reported that it found no evidence of compromised company credentials, did not observe downloads of contacts beyond what would be expected in normal operations, and saw no signs of lost funds or disclosure of recovery phrases. However, it said it is treating the newsletter list as potentially accessed while it awaits Brevo’s logs.

CoinTracking, meanwhile, said its Brevo account distributed an email titled “Data Breach Notice: Please refresh API Keys as soon as possible.” CoinTracking told recipients not to follow the email’s links.

Taken together, these responses underscore a common pattern: even when companies confirm that no funds were taken and no secret keys or recovery phrases were released, the exposure of email addresses and the ability to reach subscribers can still provide a platform for repeated social engineering.

What to watch next: breach scope and future targeting

Brevo’s report indicates that the attack relied on a failure in access controls tied to single sign-on invitations, but the company’s account-by-account impact remains partially detailed. Readers should watch for additional confirmation of which customer lists were actually exported or contacted, and whether attackers can reuse the exposed addresses for follow-on campaigns.

Senate Republicans have released a revised 630-page Clarity Act that adds federal oversight for certain crypto trading protocols five days before a scheduled Sept. 15 procedural vote.

Sen. Cynthia Lummis said on Sept. 10 that Republicans had incorporated more than 114 provisions requested by Democratic senators during negotiations. The Wyoming Republican described the new version as a bipartisan product, although no Democratic senator had publicly endorsed the revised text when it was released.

The Senate vote will determine whether lawmakers can begin formal debate on the crypto market structure bill. It is not a final vote on passage. Republicans need enough Democratic support to reach the Senate’s 60-vote procedural threshold because they control 53 seats.

Clarity Act revision targets controlled trading protocols

New language in the Clarity Act establishes a category called a “non-decentralized finance trading protocol.” The draft applies the term to people or coordinated groups that possess direct or indirect authority to control or materially change a protocol’s functions, operations or consensus rules.

Protocols covered by the definition would need to register with the Commodity Futures Trading Commission. The bill directs the CFTC and the Treasury Department to develop implementing rules, leaving the agencies to determine how the standard would work across different technical and governance arrangements.

The provision seeks to separate systems operating without a controlling party from platforms marketed as decentralized while retaining identifiable management or upgrade authority. 

Questions about control have remained central to the Senate debate over DeFi regulation. Lawmakers have disagreed over whether software developers, interface operators and governance participants should face financial compliance duties when they do not take custody of customer assets.

The latest text limits its DeFi provisions to spot and cash digital commodity transactions. Lummis said the clarification responds to concerns from tribal governments about whether the legislation could affect prediction markets, which may involve separate federal and state legal questions.

Credit unions received further clarification on permissible digital asset activity, according to her statement. Public summaries available Thursday did not identify every provision changed in the full draft.

Ethics language remains a barrier to Democratic votes

The revised Clarity Act retains an ethics provision restricting public officials, government employees and their spouses from issuing or sponsoring digital assets. Enforcement authority would remain primarily with the Justice Department, while the restriction would expire in January 2029.

President Donald Trump accepted the provision in July, but Democratic lawmakers called it inadequate. Their objections have centered on the scope of the covered activity, the limited enforcement mechanism and the provision’s expiration date.

Trump and members of his family have financial connections to World Liberty Financial and the TRUMP memecoin. Critics say legislation regulating crypto markets should contain stronger restrictions governing digital asset interests held by senior federal officials.

A separate ethics proposal developed by Democratic senators and Republican Sen. Thom Tillis sought stronger terms. The Sept. 10 revision did not adopt major elements of that alternative, according to a report from Politico.

No Democratic support had been secured for the latest version at publication time, Politico reported. The lack of public commitments leaves Republicans short of the votes required to open debate if the chamber divides along party lines.

Lummis said the bill would give the digital asset industry a durable statutory structure that could not be changed as easily as agency rules following a new presidential administration. Her statement represents the sponsors’ position on the legislation’s value and permanence.

Stablecoin rewards and bank deposits remain disputed

Banking groups and crypto companies continue to disagree over stablecoin rewards. Banks contend that rewards paid on stablecoin balances could encourage customers to move money from insured accounts, reducing deposits used to support lending.

Crypto companies argue that transaction-based incentives differ from interest paid on bank deposits. Earlier Senate language prohibited payments based solely on holding a stablecoin while permitting rewards connected with payments, loyalty programs and other qualifying activity.

The disagreement has generated lobbying campaigns in senators’ home states. Reuters reported that the Independent Community Bankers of America had arranged meetings between local bankers and senators during the August recess.

Stand With Crypto, an advocacy organization backed by Coinbase, said its supporters contacted members of Congress nearly 50,000 times during August. The group reported holding events and publishing opinion pieces across several states to support passage.

Some Republicans have raised concerns alongside Democratic critics. Sens. James Lankford and Mike Rounds have questioned whether the bill could allow certain digital tokens to compete with traditional deposits, Reuters reported.

Democrats have cited separate concerns involving money laundering controls, consumer protection and market integrity. The revised protocol language addresses one part of the illicit-finance debate, but its release did not produce an announced agreement on the remaining disputes.

The Sept. 15 vote only opens floor debate

Senate Majority Leader John Thune scheduled the procedural vote for Sept. 15, one day after senators return to Washington. The scheduled vote requires 60 senators to support moving the Clarity Act into floor consideration.

A successful vote would permit debate and open the bill to amendments. Senators could seek changes to the ethics provision, stablecoin reward rules, DeFi requirements or the allocation of authority between the Securities and Exchange Commission and CFTC.

The legislation would create federal classifications for digital assets and divide oversight between the two market regulators. The CFTC would receive authority over spot markets for assets classified as digital commodities, while the SEC would retain jurisdiction over securities.

House lawmakers previously passed their version of the Clarity Act with support from members of both parties. Any changes adopted by the Senate would require the two chambers to approve identical text before the legislation could reach Trump.

Time remains limited because lawmakers are preparing for the November midterm elections. Reuters reported that crypto companies view the remaining 2026 legislative calendar as a critical opportunity, while analysts described the bill’s prospects as uncertain because of opposition from Democrats and several Republicans.

Lummis, who is not seeking another Senate term and will leave Congress in January 2027, has continued pressing lawmakers to approve the measure. In a Sept. 9 statement, she argued that the United States should set its own crypto rules instead of allowing jurisdictions such as Singapore or the United Arab Emirates to take the lead.

If the motion receives at least 60 votes, Senate leaders can proceed to debate and schedule amendment votes. Fewer than 60 votes would prevent the chamber from moving to the current bill unless leaders negotiate new terms and schedule another procedural attempt.

Sam Bankman-Fried has asked the U.S. Supreme Court to overturn his seven-count fraud conviction and approximately $11 billion forfeiture order after losing his appeal in June 2026.

CNN, which reviewed the petition filed on Sept. 10, reported that the former FTX chief wants a new trial over limits placed on evidence concerning FTX’s assets and the potential repayment of customers. He is serving a 25-year federal prison sentence imposed in March 2024.