A Senate vote could shape US crypto regulation as SEC Chair Paul Atkins backs the CLARITY Act. Atkins expects lawmakers to advance the bill this month, despite delays and pressure from the approaching elections. The Senate plans a September 15 cloture vote, which could clear the way for debate and final action.

Atkins said the SEC is preparing rules that could work alongside the legislation. The agency is collecting comments on exemptions covering fundraising and digital asset activities. Meanwhile, Atkins said the SEC could use existing securities laws if Congress fails to establish a new framework.

The SEC chair supports the legislation because it could create a lasting legal structure for digital assets. Such rules could reduce uncertainty because future SEC leaders would face statutory boundaries. Consequently, the bill could shape how regulators approach crypto markets beyond the current administration.

Senate Vote Sets Up Clarity Act Test

The September 15 cloture vote represents an important procedural test for the market structure bill. A successful vote could end debate and allow senators to consider the legislation. However, lawmakers face limited time before election activity could reduce legislative momentum.

The CLARITY Act previously passed the House and later advanced through the Senate Banking Committee. An earlier attempt to bring the measure before the Senate failed to gain support. Therefore, the upcoming vote has become a measure of whether lawmakers can revive the bill.

Industry reactions also show mixed expectations about the legislation’s path through Congress. SALT CEO John Darsie has questioned whether lawmakers can finish the measure before the political calendar tightens. Prediction market Kalshi has placed the chance of enactment this year near 49%.

Clarity Act Defines Crypto Oversight

The proposed law would establish clearer responsibilities for the SEC and Commodity Futures Trading Commission. It would also create registration requirements for crypto companies and introduce anti-money laundering obligations. Those provisions would give digital asset firms a defined route.

The legislation still faces disputes over stablecoin rules and other policy issues. One debate concerns whether stablecoin holders should receive interest from their digital asset holdings. Lawmakers also discuss ethics rules involving public officials with digital asset interests.

The bill forms part of wider US asset regulation. Atkins has indicated that the SEC could introduce a tokenization innovation exemption soon. Additionally, the agency has proposed updated transfer agent rules for blockchain securities and digital share transfers.

Sec Advances Parallel Crypto Rules

The SEC’s separate initiatives could reshape market practices while Congress considers the CLARITY Act. Its exemptions address fundraising and other activities facing securities law requirements. Public comments could influence the final structure of those changes.

Atkins has argued that agency action can provide immediate relief under existing securities laws. However, legislation would give those changes legal support and could make them harder for future leaders to reverse. Hence, congressional action remains central to creating a durable framework for the crypto industry.

The vote will show whether lawmakers can overcome delays and move the bill forward. If the measure advances, negotiations could continue toward final congressional approval and presidential action. If it stalls again, the SEC may continue developing rules under its authority.

Thailand is tightening oversight of crypto transfers, including transactions involving self-custodial wallets, as it moves to align with global Anti-Money Laundering (AML) standards.

Thailand’s Securities and Exchange Commission (SEC) issued new Travel Rule regulations requiring digital asset operators to collect information about parties involved in crypto transfers, the regulator announced Wednesday.

The rules will take effect on Feb. 27, 2027, giving crypto businesses nearly six months to develop systems for transmitting, receiving and monitoring transaction information.

Thailand joins a growing global push to track who sends and receives crypto, as the Financial Action Task Force (FATF) estimated that 83% of surveyed jurisdictions had passed Travel Rule legislation as of 2026.

Self-custodial wallets face ownership checks

Under the new framework, Thai digital asset operators must verify the ownership or control of self-hosted, or self-custodial, wallets when customers send crypto to or receive it from those wallets.

Unlike wallets managed by centralized exchanges (CEXs) or custodians, self-custodial wallets give users direct control over the private keys needed to access their crypto.

Operators must also retain information accompanying every digital asset transaction for at least five years and make the records available for regulatory examination.

The requirements put more responsibility on crypto companies to identify the parties behind transfers, including those involving self-custodial wallets. Pornanong Budsaratragoon, secretary-general of Thailand’s SEC, said the rules aim to “reduce the risk of digital asset operators being used for money laundering and terrorist financing.”

Thailand moves from consultation to final rules

The final rules follow two rounds of public consultation this year, starting with proposed principles in March and a draft notification in June. The SEC said most stakeholders supported the proposals.

The Travel Rule comes as Thailand considers expanding access to other regulated crypto products. On Monday, the SEC proposed allowing intermediaries to offer retail investors access to certain crypto derivatives traded on regulated overseas exchanges.

Days earlier, the regulator advanced draft rules for spot Bitcoin and Ether exchange-traded funds (ETFs), while also seeking feedback on requirements for foreign digital asset custodians used by funds investing in crypto.

Magazine: Thailand’s 0% crypto tax. Bitcoin Red Team forced to use Chinese AI: Asia Express

U.S. federal law enforcement says it has helped disrupt a long-running cybercrime operation tied to cryptocurrency theft, working alongside international partners and private-sector cybersecurity experts. The Justice Department announced that the Sality malware and its botnet infrastructure were targeted in an effort spanning multiple countries.

According to the U.S. Justice Department, the operation involved Bulgarian, Hungarian and Romanian authorities, as well as partners including CrowdStrike and the Shadowserver Foundation. The department said Sality was used to compromise devices and facilitate theft of digital assets, with activity traced back to 2003.

Key takeaways

• The U.S. Justice Department said it disrupted the Sality botnet and associated malware in an international takedown effort.
• CrowdStrike linked the scheme to clipjacking behavior that targets cryptocurrency wallet addresses copied to a clipboard.
• U.S. officials and CrowdStrike described a peer-to-peer botnet of roughly 15,000 infected computers checking connectivity every 40 minutes.
• CrowdStrike reported at least 12.1 million rubles (about $150,000) stolen over an eight-year period tied to “never-spent” digital assets, with a peak value around January 2025.

What the Justice Department says was targeted

In a Tuesday notice, the U.S. Justice Department stated that it had “disrupted the Sality botnet and malware” through a coordinated international operation. The department’s announcement names government agencies in Bulgaria, Hungary and Romania, while also citing private-sector support from CrowdStrike and the Shadowserver Foundation.

Officials said Sality malware was responsible for installing malicious code on compromised systems. They tied that activity to both cryptocurrency theft and broader cyberattacks. While the announcement frames the action as a disruption rather than a total elimination, the message is clear: the takedown interfered with the malware’s ability to coordinate with infected machines.

The announcement also underscores why botnets remain a key threat vector for the crypto sector. Malware operators can use compromised endpoints to manipulate users and move stolen assets, turning ordinary wallet operations—like copy-and-paste—into moments of vulnerability.

The clipjacking mechanism behind the crypto theft

CrowdStrike provided technical detail on how actors behind Sality allegedly harvested cryptocurrency payments. In a post describing the operation, the company said the criminals used EggJagger, described as a “clipjacking tool” that monitors a device’s clipboard for cryptocurrency wallet addresses.

The method is designed to be difficult for victims to notice. When a user copies a Bitcoin or Ethereum address to send funds, CrowdStrike said the malware can silently replace that address with one controlled by the attacker. In its explanation, CrowdStrike said that “funds are redirected” when the victim pastes the altered destination address into a payment.

This matters for investors and users because it highlights a persistent class of wallet-related risk: attacks do not always require users to install obviously malicious software. Instead, they can compromise normal device behavior and quietly reroute transactions.

Scale and operational details described by CrowdStrike

CrowdStrike said that in the eight years preceding the disruption, the operators behind Sality used EggJagger to steal at least 12.1 million rubles—about $150,000 in cryptocurrency—by redirecting copied wallet addresses. The company also reported that the value of the “never-spent” digital assets peaked at about $1.5 million in January 2025.

Officials and CrowdStrike described a network architecture built around peer-to-peer communication. In their account, around 15,000 infected computers formed a botnet that would check whether systems were online every 40 minutes. The operational cadence is notable: such periodic communication patterns often help attackers maintain control while keeping command-and-control traffic manageable.

As a result of the authorities’ efforts, CrowdStrike and U.S. officials said the criminals “lost the ability to communicate with infected machines.” That shift is a practical outcome of takedowns: even if some malware remains on endpoints, the attacker’s capacity to coordinate, update tactics, or manage automated theft can be severely reduced.

Why this takedown is significant for crypto security

Criminal ecosystems built around clipboard manipulation reflect a larger reality for the cryptocurrency space: user behavior and device integrity are often the weakest links. The Sality/EggJagger case demonstrates that even basic actions—copying addresses—can become an attack surface when malware is present.

For defenders, the episode reinforces the importance of hardening endpoints and monitoring for suspicious clipboard activity, not just traditional signs of malware infection. For crypto users, it strengthens the case for safer transfer practices such as verifying addresses through trusted channels and being cautious when transactions are prepared on potentially compromised systems.

From a broader market perspective, disruptions like this can reduce the flow of stolen assets—though the exact immediate impact is hard to quantify from public reporting alone. What is clear from the announcements is that law enforcement and security researchers were able to interfere with a mature cybercrime setup that had been active for years.

Looking ahead, readers should watch for two things: whether additional reporting clarifies how many victims were impacted in total, and whether security teams publish indicators or mitigation guidance connected to Sality and EggJagger techniques. As the ability to communicate with infected machines has been disrupted, the more enduring question is how quickly attackers will attempt to reconstitute similar clipboard-stealing capabilities elsewhere.