Notional Finance may have suffered a $1.7 million exploit involving an escrow contract, blockchain investigators reported on Sept. 4. The reported losses include approximately $69,242 in DAI and $1.66 million in USDC.

Security firm PeckShield cited findings published by blockchain investigation group Specter. Neither report provided a complete technical explanation of how the assets left the contract.

“The Notional Finance escrow contract may have been exploited,” PeckShield said, preserving uncertainty about the incident’s status.

Notional Finance exploit report identifies two addresses

Researchers identified two Ethereum addresses allegedly connected to the movement of the assets. The first address is 0xC954…De69, while the second is 0xDaCC…Ce38.

The addresses were labelled as theft addresses by Specter. That description remains an investigator attribution rather than a finding confirmed by Notional Finance, law enforcement or a court.

The available reports do not identify the precise escrow function involved. They also do not establish whether the event resulted from a smart-contract vulnerability, compromised credentials, faulty permissions or another cause.

Stablecoins were reportedly converted into 689.2 ETH

The suspected attacker reportedly exchanged the DAI and USDC for approximately 689.2 ETH. The Ether was then deposited into Tornado Cash, according to Specter and PeckShield.

Tornado Cash is a set of Ethereum smart contracts designed to reduce the visible connection between deposits and later withdrawals. Its use can complicate blockchain tracing, although depositing assets into the protocol does not independently prove criminal ownership or intent.

The rapid conversion of stablecoins may also reduce opportunities for issuers or centralized platforms to restrict the assets. Both DAI and USDC can be followed publicly before conversion, while subsequent withdrawals from a mixer become harder to associate with the original address.

In related coverage, crypto.news reported that an address tied to the Drift Protocol exploiter moved $44 million through Tornado Cash after remaining inactive for several months.

No technical cause or official response is available

Notional Finance had not published a public incident report or confirmation through its official account when checked. The project had also not disclosed whether contracts were paused, whether remaining assets were secured or whether users needed to take protective action.

The lack of confirmation means the reported $1.7 million loss should remain described as preliminary. It is also unclear whether the affected assets belonged directly to users, the protocol treasury or another party using the escrow contract.

No verified market reaction can be attributed to the report. Without an official assessment, linking token-price movements or changes in deposited value directly to the suspected exploit would be premature.

Previous recoveries depended on rapid containment

DeFi projects commonly respond to suspected exploits by pausing vulnerable contracts, contacting stablecoin issuers and exchanges, tracing connected wallets and offering return agreements. Those options can become more limited after assets enter privacy protocols.

Some projects have still recovered positions or protected unaffected products after an attack. As crypto.news reported, Term Labs recovered its affected fixed-rate positions following an $8.5 million governance exploit, although several products remained closed.

Stake DAO also secured its Ethereum backing and closed a bridge after an unauthorized minting incident, according to related coverage. Those cases involved direct project responses that are not yet available for Notional Finance.

Meanwhile, Notional Finance operates as an Ethereum-based lending protocol focused on fixed-rate, fixed-term borrowing. Its documentation explains that deposited currencies can support borrowing obligations denominated in other currencies. 

This makes contract-level accounting and collateral controls central to maintaining solvent user positions. However, researchers have not established whether the reported escrow incident affected Notional’s primary lending system, a separate integration or an older contract.

DAI and USDC have long formed part of Notional’s supported lending markets. The protocol’s technical materials describe currency pairs connecting those stablecoins with their interest-bearing equivalents. 

The reported loss therefore involves assets used within Notional’s broader lending architecture, but the available evidence does not show that open loans, collateral balances or fixed-term positions were affected. An official contract identification is needed before the exposure can be measured accurately.

What happens next for Notional Finance

The next confirmed update would likely need to establish which contract was involved, how the transactions were authorized and whether other funds remain exposed. A post-mortem could also clarify the ownership of the lost assets.

Investigators may continue tracking any Ether withdrawn from Tornado Cash. Exchanges and blockchain analytics companies could monitor later transactions, but the reported mixer deposits make attribution and recovery more difficult. Until Notional publishes an assessment, the scale, cause and effect on users remain unresolved.

Curve DAO approved yRisk as its new risk-management provider for crvUSD and Llamalend on Sept. 2, assigning the mandate to two contributors who are also primary developers of Resupply.

The binding onchain vote closed with approximately 621.2 million veCRV supporting the proposal and 5.33 veCRV opposing it. The proposal was executed about 87 minutes after voting ended.

yRisk will receive 125,000 frxUSD and 568,181 CRV through separate revocable vesting streams lasting one year. The package represents the team’s requested annual budget of approximately $250,000.

Curve DAO gives yRisk a twelve-month mandate

yRisk will provide risk assessment and monitoring across crvUSD mint markets and Llamalend isolated lending markets. Its responsibilities include reviewing collateral, liquidity, oracle design, concentration and governance risks.

The team will also recommend debt ceilings, market parameters, PegKeeper limits and other risk controls. Curve governance and its emergency DAO retain authority over final decisions and execution.

According to its original proposal, yRisk plans to build public monitoring systems, dashboards, alerts and automated code-analysis tools. Work funded by the mandate will generally be released under an open-source license.

The team consists of contributors known as Wavey and Dudesahn. The proposal identifies both as core developers at Yearn and Resupply and describes them as Resupply’s primary developers.

Resupply exploit was absent from reviewed materials

Resupply suffered a donation attack in June 2025 that caused approximately $9.6 million in losses. A QuillAudits analysis attributed the incident to exchange-rate manipulation affecting a lending market.

The attacker donated assets to a nearly empty vault, causing an exchange-rate calculation to round toward zero. That manipulation allowed the attacker to borrow against artificially inflated collateral.

yRisk’s Curve proposal disclosed its contributors’ Resupply roles but did not mention the exploit. Curve’s comparative assessment also discussed their Resupply experience without referring to the incident.

The omission does not establish that yRisk violated a disclosure requirement. Curve’s call for proposals requested relevant experience, methodology, capacity and pricing, but the published requirements did not expressly demand disclosure of every incident involving a contributor’s previous projects.

Curve reviewers identified a staffing concern

Swiss Stake reviewed nine competing applications before Curve conducted its preference votes. Its assessment credited yRisk with practical knowledge of Curve, Llamalend, Yearn and Resupply.

The review also identified capacity as its main concern. It questioned whether two contributors with other responsibilities could monitor a growing number of markets and provide adequate incident coverage.

“It is not yet clear whether they can sustain that workload and provide sufficient incident coverage as the number of markets expands,” Swiss Stake said.

The statement described uncertainty rather than a finding that yRisk lacked the necessary resources. Swiss Stake recommended an initial limited mandate and a public review checkpoint for whichever provider Curve selected.

During a nonbinding preference vote, yRisk received approximately 536.97 million veCRV votes in favor and none against from 47 voters. That represented about 68.78% of the voting supply at the snapshot block.

yRisk replaces LlamaRisk across Curve markets

Curve began seeking a replacement after LlamaRisk ended its engagement early. LlamaRisk had renewed its mandate in April 2026 with plans to continue through April 2027.

The provider announced its departure on May 29 and stopped active work on June 30. It returned approximately 270,247 crvUSD in unvested funding to Curve’s treasury.

LlamaRisk described the departure as a structural decision about how it allocated resources, rather than criticism of Curve. Curve opened its replacement process on July 7.

The new mandate arrives as Curve expands Llamalend. Crypto.news previously reported that Llamalend v2 introduced isolated lending markets on Optimism before a planned Ethereum deployment.

Risk management has remained a central concern for the ecosystem. In March, an improperly configured oracle enabled an attacker to extract approximately $240,000 from a Llamalend market, as crypto.news reported in its coverage of the sDOLA-crvUSD pool exploit.

Public reporting will test yRisk’s delivery

yRisk must now review LlamaRisk’s existing reports, models, dashboards and repositories. The team will determine which resources should be retained, rebuilt or retired.

Its proposal commits to monthly progress reports, continuous monitoring and incident support. The revocable funding structure gives Curve DAO the ability to stop the remaining vesting streams before the twelve-month term ends.

A future public review would allow governance participants to assess whether yRisk has met its monitoring, reporting and response commitments. Curve has not announced a specific date for that checkpoint.

Hargreaves Lansdown opened access to nine Bitcoin and Ether exchange-traded notes on Sept. 3, bringing regulated cryptocurrency exposure to eligible users of the United Kingdom’s largest retail investment platform.

The products come from BlackRock’s iShares, WisdomTree, 21Shares, Invesco, CoinShares and Bitwise, according to a Financial Times report. The issuers charge annual product fees ranging from 0% to 0.35%.

Hargreaves Lansdown serves approximately two million investors. However, the crypto ETNs are only available through its Advanced Investing service and are not automatically accessible to every customer.

Hargreaves Lansdown adds crypto after long delay

The launch comes almost 11 months after the Financial Conduct Authority ended its four-year restriction on retail access to qualifying crypto ETNs. Other major British investment platforms had already introduced the products.

Hargreaves Lansdown initially adopted a more cautious position. In October 2025, the platform told investors that “Bitcoin is not an asset class,” while acknowledging that some customers might still want speculative exposure.

Doug Abbott, Hargreaves Lansdown’s chief product officer, said the platform delayed its launch to ensure client testing and safeguards were properly designed. He said customers should understand the products and encounter the “right level of friction” before investing.

The company’s current crypto ETN page warns that the instruments are volatile and high risk. It says investors could lose all the money they commit.

Investors face eligibility checks and a waiting period

Customers must first self-certify as advanced investors. They must then complete an online appropriateness assessment designed to test whether they understand the products and associated risks.

Eligible customers must also complete a 24-hour cooling-off period before viewing the available ETNs. They need either a Fund and Share Account or a self-invested personal pension to buy, hold or sell the instruments.

Hargreaves Lansdown charges a 0.35% annual platform fee for holding crypto ETNs, capped at £12.50 per month. Dealing charges range from £3.95 to £6.95, depending on the customer’s trading frequency. These charges are separate from each product’s management fee.

The notes trade during London Stock Exchange market hours. They do not provide continuous 24-hour trading like cryptocurrency exchanges.

Crypto ETNs provide exposure without direct ownership

Crypto ETNs are listed financial instruments designed to follow the price of an underlying digital asset. Investors purchase a note issued by a financial institution rather than buying Bitcoin or Ether directly.

The issuer arranges custody of the underlying cryptocurrency. Customers therefore do not control private keys, manage wallets or withdraw the digital assets represented by their investment.

This structure introduces risks that differ from direct cryptocurrency ownership. Investors depend on the issuer, custodian, trading venue and investment platform. Product fees and market spreads may also cause returns to differ from movements in the underlying asset.

Crypto.news previously reported that BlackRock listed its Bitcoin product on the London Stock Exchange after the retail restrictions changed. The listing was among several products introduced as regulated providers prepared for wider individual access.

FCA rules restrict how platforms offer crypto ETNs

The FCA lifted its retail prohibition on qualifying crypto ETNs on Oct. 8, 2025. Products must appear on the regulator’s Official List and trade through a recognized U.K. investment exchange.

The regulator classifies the products as restricted mass-market investments. Its official guidance requires appropriateness assessments, customer categorization, cooling-off periods and prominent risk warnings.

Platforms cannot offer incentives encouraging customers to invest. They must also identify an appropriate target market and take reasonable measures to prevent foreseeable consumer harm.

As crypto.news reported when the policy was announced, the FCA reopened retail access while keeping crypto derivatives prohibited. The regulator said investors would not receive the same protections available for conventional regulated investments.

Demand remains an open question

Hargreaves Lansdown said it had received a consistent level of customer enquiries about crypto ETNs, particularly from experienced investors. That interest has not yet established how many eligible clients will invest.

Other platforms have described British retail uptake as modest. Restrictions preventing newly purchased crypto ETNs from being held in conventional stocks-and-shares ISAs may also limit demand.

The launch nevertheless gives Hargreaves Lansdown customers a regulated route to Bitcoin and Ether price exposure without opening an exchange account. Future adoption will depend on investor demand, cryptocurrency prices and whether the available product range expands.

El Salvador has provided documentation showing that its Bitcoin accumulation since June 27, 2025, came from private donations rather than public resources, according to the International Monetary Fund.

The disclosure appeared in a Sept. 3 IMF statement announcing a staff-level agreement covering the combined second and third reviews of the country’s Extended Fund Facility.

The IMF said it also reached an understanding with Salvadoran authorities that no further Bitcoin accumulation beyond the documented donations is expected. The announcement does not identify the donors or specify the amount of Bitcoin received privately.

El Salvador Bitcoin records address funding questions

The latest disclosure helps explain apparent increases in wallets associated with El Salvador’s Strategic Bitcoin Reserve. Those increases had raised questions about whether the government was continuing to purchase Bitcoin despite its IMF commitments.

The IMF said Salvadoran authorities supplied documentation verifying that the accumulation recorded after the first EFF review reflected private donations. It stated that no public money financed those additions.

The distinction matters because blockchain records can show assets entering a wallet but do not automatically identify whether they came from purchases, internal transfers or donations. Crypto.news previously examined how government wallet movements can create misleading impressions of sovereign Bitcoin purchases.

In July 2025, IMF documentation said the total amount held across government-controlled wallets remained unchanged. It explained that some reported increases reflected Bitcoin consolidation among different state-controlled addresses.

Earlier crypto.news reporting also found that daily Bitcoin purchase claims conflicted with IMF program disclosures. The new documentation introduces private donations as the source of accumulation recorded after June 27, 2025.

IMF agreement could release another $140 million

IMF staff and Salvadoran authorities reached their agreement following the combined second and third EFF reviews. The arrangement remains subject to approval by the IMF Executive Board and completion of agreed prior actions.

If those requirements are met, El Salvador would receive approximately $140 million, equivalent to SDR 101.96 million. The IMF approved the 40-month EFF in February 2025 with total access of approximately $1.4 billion.

The country has received SDR 172.32 million under the program so far. The IMF described the latest agreement as preliminary because its Executive Board has not approved the reviews or authorized the additional disbursement.

The Fund said El Salvador’s economic activity had exceeded earlier expectations. It projects real gross domestic product growth of 4.5% in 2026, supported by investment, consumption, remittances, tourism and capital inflows.

That forecast remains subject to economic conditions. IMF staff also called for continued fiscal consolidation, stronger governance and a reduction in public debt toward 80% of GDP by 2030.

Chivo wallet moves under private control

El Salvador has substantially reduced public participation in Chivo, the electronic wallet introduced alongside its Bitcoin policy. Majority ownership and operational control have been transferred to an unidentified private operator.

The government retained a minority stake and custodial responsibilities for customer assets. The IMF said authorities were also working to improve transparency surrounding Bitcoin held across different wallets.

The transfer follows prolonged discussions over reducing the government’s direct role in crypto services. As crypto.news previously reported, negotiations over Chivo formed part of the wider IMF funding arrangement.

Under the original EFF conditions, El Salvador made private-sector Bitcoin acceptance voluntary, required taxes to be paid in U.S. dollars and limited public-sector participation in Bitcoin-related activities.

No further Bitcoin accumulation is expected

The IMF said it reached an understanding that El Salvador would not accumulate more Bitcoin beyond the documented private donations. The wording describes an expectation under the staff-level agreement rather than an independently enforceable ban announced by the Fund.

“Going forward, no further Bitcoin accumulation beyond the documented donations is expected,” IMF staff said.

The two sides also agreed to pursue changes to El Salvador’s legal, regulatory and supervisory framework for digital assets. Planned work includes strengthening governance and risk controls for crypto assets held by the public sector.

The Executive Board must now consider the staff report. Until it approves the reviews and El Salvador completes the required actions, the additional $140 million remains unavailable.

Bitcoin recorded its strongest monthly gain since November 2024 during August, but Fidelity said the advance does not prove that the latest crypto bear market has ended.

In its fourth-quarter crypto market outlook, Fidelity said Bitcoin, Ethereum and several altcoins recorded their strongest positive months since late 2025. Bitcoin gained more than 25% during the third week of August alone.

Ethereum rose 34.1% during the same period, while Solana advanced 28%, according to Fidelity. The gains followed relatively subdued market activity from June through the middle of August.

However, Fidelity warned that the rally could represent either the beginning of a sustained recovery or a temporary move within a continuing bear market.

Bitcoin bear market faces a November cycle test

Some investors are watching November 2026 as a possible market-bottom period based on Bitcoin’s historical four-year cycle. Bitcoin’s previous major bear-market bottom occurred in November 2022.

Applying the same approximate interval would place the next potential bottom around November 2026. Fidelity stressed that historical cycles have never followed precise four-year schedules and cannot reliably identify market turning points.

The firm said Bitcoin may have already reached its low in July. It could also decline again and establish another low during November or later.

“Despite the recent push higher in price, there is no guarantee the bear market is over,” Fidelity said.

Chris Kuiper, vice president of research at Fidelity Digital Assets, said adoption has historically occurred in waves that can help sustain market cycles. He argued that a longer holding period has generally proved more useful than attempting to time exact bottoms.

That view remains an observation based on historical performance. It does not establish that Bitcoin will repeat an earlier cycle or continue appreciating.

Volatility shift offers a possible recovery signal

Fidelity identified Bitcoin’s transition from lower volatility to a sharp upward expansion as one possible sign that sellers were becoming exhausted.

Kuiper said digital assets experienced relatively low volatility between June and mid-August. Fidelity’s analysis placed assets such as Bitcoin near the lower, or “value,” end of their historical ranges during that period.

The subsequent rally resembled volatility patterns seen near some previous bear-market endings. Bitcoin’s rapid advance above $80,000 was followed by a retreat toward $79,250, as crypto.news reported in its analysis of overbought conditions increasing short-term pullback risks.

That technical reading did not establish a new bear market. It showed that Bitcoin had risen rapidly enough to increase the probability of consolidation after the advance.

Kuiper also noted that developments which might previously have pressured prices, including a hardware-wallet security incident and delays surrounding the CLARITY Act, did not reverse the August rally.

This resilience “could further strengthen the case” that cryptocurrencies are near a bottom, Kuiper said, while stopping short of confirming one.

Adoption continued while cryptocurrency prices weakened

Fidelity said digital-asset adoption remained resilient during the earlier market decline. Stablecoin transaction volume, tokenized real-world assets and institutional participation continued growing even as the broader market capitalization weakened.

The firm described network adoption measures as comparable to fundamental indicators used when evaluating traditional businesses. Rising transaction activity can demonstrate continued use, although it does not guarantee higher token prices.

Institutional investment products also showed mixed allocation patterns before Bitcoin’s August rally. In related coverage, crypto.news reported that Ethereum funds attracted more capital than Bitcoin funds during July.

Bitcoin exchange-traded fund demand subsequently recovered during August. Fidelity listed stronger institutional adoption among the factors that could support another bull market, alongside regulatory changes, monetary policy and new blockchain use cases.

U.S. policy decisions remain key fourth-quarter catalysts

The U.S. regulatory calendar could provide two major tests during the fourth quarter. The CLARITY Act remains pending in the Senate after the Senate Banking Committee advanced it by a bipartisan 15–9 vote in May.

A procedural vote is scheduled for Sept. 15 and requires 60 votes to advance the bill toward debate. The legislation would divide elements of digital-asset oversight between the SEC and CFTC. However, passage remains uncertain, and further amendments could require additional House consideration.

As crypto.news reported, the bill now faces a tight congressional timetable before the midterm elections.

Separately, the SEC proposed Regulation Crypto Assets on Aug. 18. The proposed framework would create two securities-registration exemptions for qualifying crypto investment contracts.

The SEC’s formal proposal would allow eligible offerings of up to $5 million over four years or $75 million during a 12-month period, subject to specific conditions. Public comments are due by Oct. 20.

Crypto.news previously examined how the proposed exemptions would reshape token fundraising. The proposal is not final and may change following public feedback.

These policy proceedings, monetary conditions and institutional participation could shape Bitcoin’s fourth-quarter direction. None provides confirmation that the bear market has ended, leaving price action and adoption data as continuing tests of the August recovery.

The United States and United Kingdom have formed a joint law enforcement alliance targeting scam centers involved in crypto and cyber-enabled investment fraud. 

On Thursday, the US Department of Justice announced that the US Attorney’s Office for the District of Columbia, the Crown Prosecution Service of England and Wales and the UK National Crime Agency signed a memorandum of understanding. The DOJ described it as the “first-of-its-kind” international cooperation agreement aimed at disabling such scam centers.

Under the agreement, the agencies will conduct parallel investigations into common targets, share information on organized crime syndicates and discuss which jurisdictions should prosecute specific cases. The DOJ said the authorities have already identified overlapping cases and plan an in-person disruption operation with private-sector partners in London in early October.

The cross-border pact comes as reported US losses from crypto investment fraud continue to climb. Losses reported to the FBI’s Internet Crime Complaint Center rose 89% from $4.57 billion in 2023 to $8.65 billion in 2025, according to the DOJ. 

International efforts target crypto scam compounds

The agreement expands the Scam Center Strike Force, which US Attorney Jeanine Ferris Pirro launched in November 2025 to target Chinese organized crime networks operating scam centers primarily in Southeast Asia. Their schemes include crypto investment fraud and are often linked to human trafficking and money laundering, according to the DOJ. 

The task force includes the FBI, US Secret Service, Internal Revenue Service Criminal Investigation, Homeland Security Investigations and Justice Department offices. It also works with the US Treasury and State departments and private companies to disrupt scam operations and recover victims’ funds.

Related: Chinese newspaper warns of Bitcoin extortion scam using its name

International authorities have coordinated raids against similar operations. On April 29, the DOJ reported a Dubai police-led operation involving the FBI and China’s Ministry of Public Security, which resulted in 276 arrests and the closure of at least nine crypto scam centers. Six people were charged over schemes that allegedly used fake crypto investment platforms to solicit deposits from victims. 

Governments in Southeast Asia have also pursued tougher domestic measures. On May 15, Myanmar’s military government had released draft legislation proposing sentences ranging from 10 years to life in prison for digital currency fraud, with the death penalty possible when people coerced into working at scam centers were killed. 

On July 28, Parliament approved the bill, though presidential assent had not been confirmed.

Magazine: Recovery specialists crack $1B crypto wallet… but find just $10