The U.S. Senate’s failure to advance the Digital Asset Market Clarity (CLARITY) Act has prompted expectations of faster, more direct rulemaking from the SEC and CFTC, according to analysts at Bernstein. With the bill not moving forward after a cloture vote on Tuesday, Bernstein said regulators are likely to “make up for the time lost” in developing their own frameworks for crypto markets.

In a Wednesday note shared with Cointelegraph, Bernstein argued the shift could still deliver meaningful regulatory guidance for the industry, even if the legislative approach that would have “fool-proofed the industry against political regime shifts” did not materialize. The analysts expect new agency rules to address issues ranging from how tokens are categorized to how certain decentralized finance (DeFi) activities might be treated.

Key takeaways

• With CLARITY failing to clear a cloture vote, Bernstein expects the SEC and CFTC to accelerate rulemaking instead of relying on a new statutory framework.
• New guidance may include token taxonomy for fundraising and investor protections aimed at developers and self-custodial protocols.
• Bernstein anticipates “innovation exemptions” that could support equity tokenization efforts under defined conditions.
• The SEC’s earlier proposal to clarify treatment of certain “investment contracts” provides a starting point for how regulators may structure safer harbors.

Why CLARITY’s setback changes the regulatory playbook

Earlier coverage from Cointelegraph noted that the U.S. Senate failed to advance the CLARITY Act after a cloture motion did not pass on Tuesday. The bill, according to Bernstein, would have offered the country’s first dedicated regulatory framework for digital assets.

Bernstein’s central point is that the regulatory agencies now have a new timeline pressure. Rather than continuing negotiations tied to the legislation’s prospects, the SEC and CFTC are expected to publish regulations meant to provide clarity more immediately. Bernstein also suggested that bringing the act back for another vote is unlikely, citing a limited window and concerns about ethics provisions.

For market participants, the practical implication is that uncertainty may persist—but it could shift form. Instead of waiting for Congress to define broad categories and boundaries, firms may need to adapt to agency rules that are narrower in scope yet faster to implement.

SEC groundwork: proposed rules for “certain investment contracts”

Bernstein’s expectations build on actions the SEC has already taken. On Aug. 19, Cointelegraph reported that the SEC proposed new rules to establish what the agency described as a “clear and fit-for-purpose framework for certain investment contracts involving crypto assets.” Those proposals are designed to let entities raise capital while preserving investor protection.

As reported by Cointelegraph, the SEC’s proposal includes exemptions that would allow crypto firms to issue up to $5 million in tokens over four years and up to $75 million over 12 months, along with a safe harbor intended to exempt cryptocurrencies from being treated as “investment contracts.”

Bernstein’s note implies that the agencies may use this approach as a template—tightening, expanding, or operationalizing rule details in response to the missed legislative path. Investors and token issuers, in turn, may focus on how their offerings fit within the boundaries of these frameworks, particularly around how contracts and rights are structured.

What Bernstein expects from the SEC and CFTC next

Bernstein said it expects agency regulations to cover several concrete areas for crypto businesses. The analysts highlighted token taxonomy for raising capital—an issue that matters because how regulators classify tokens can determine whether an offering or program is treated like an investment contract or falls under other regulatory categories.

Bernstein also pointed to developer protection measures for DeFi and self-custodial protocols. For builders, this could be significant: it suggests rulemaking may aim to address common architectural realities in DeFi where developers may not control user custody or operational decisions, while still addressing how investor protection principles apply.

In addition, Bernstein expected “innovation exemptions” for equity tokenization, implying regulators may carve out room for certain issuance models that resemble traditional equity structures—potentially with conditions intended to prevent broad sales practices from evading oversight.

Finally, Bernstein referenced faster approval times for real-world asset (RWA) perpetual futures and amendments to rules around federal sports even contracts and their classification as swaps. While these items are more technical and specific, they point to the agencies’ willingness to address market structure questions, not just fundraising token frameworks.

For traders and liquidity providers, the takeaway is that regulatory clarity might arrive in multiple layers: rules affecting issuance and governance may be complemented by guidance on derivative products and contract classifications.

Signals of urgency from SEC leadership

The sense that the SEC would move quickly without CLARITY is reinforced by public messaging from SEC leadership. Cointelegraph previously reported that on July 27, SEC Chair Paul Atkins told CNBC the agency was “ready, willing, and able to come out with rules” on digital assets if the Senate failed to pass the CLARITY Act.

This matters because it frames the likely regulatory response as proactive rather than reactive. If Bernstein’s expectation holds, firms should anticipate rulemaking momentum that is less dependent on congressional timing, even if the details ultimately differ from what a bill like CLARITY would have provided.

Where the picture remains uncertain is how comprehensively the agencies will harmonize their approaches across token issuance, DeFi developer responsibilities, and the treatment of derivative products. Bernstein expects a compensating wave of regulatory work, but the industry will still need to watch how the rules are finalized and how they apply in practice.

Next, market participants should monitor the SEC and CFTC for concrete drafts and timelines—especially around token taxonomy and any safe harbor or exemption mechanics that could determine how token offerings, DeFi participation, and certain derivative structures are regulated once CLARITY is off the table.

Circle has launched the public mainnet of Arc on Sept. 16, bringing its USDC-powered Layer 1 blockchain online with institutional validators, more than 20 fiat stablecoins and tokenized funds available from launch.

Circle said in itsofficial Arc mainnet announcement that the network uses USDC as its native gas asset, provides deterministic settlement in under one second and supports Ethereum Virtual Machine applications, allowing developers to use Solidity contracts and familiar Ethereum development tools.

The public opening follows an Arc testnet that processed more than 700 million transactions, according to Circle’s launch announcement. Circle’s second-quarter SEC filing had recorded 502 million cumulative testnet transactions and 2.8 million transacting wallets as of June 30, showing that activity continued climbing before the September launch.

Key takeaways

• Bitcoin traded near $75,950 after falling more than 1% on Tuesday.
• Ethereum and XRP declined more than 4% and 9%, respectively.
• BTC remains above its 50-day, 100-day, and 200-day EMAs.

Bitcoin (BTC) traded near $75,950 on Wednesday after declining more than 3% during the previous session as the CLARITY Act failed to advance in the US Senate.

Ethereum and XRP suffered steeper losses, falling more than 4% and 9%, respectively. Despite the market-wide pullback, Bitcoin remains above its major exponential moving averages, preserving its broader bullish structure.

Traders now await the Federal Reserve’s interest-rate decision and Chair Kevin Warsh’s forward guidance, which could determine the cryptocurrency market’s next major move.

CLARITY Act failure pressures crypto prices

The cryptocurrency market weakened on Tuesday after the CLARITY Act failed to secure sufficient support to advance in the Senate.

The setback reduced expectations that Congress would soon establish a comprehensive regulatory framework for the US digital-asset market. Bitcoin fell more than 3%, while greater selling pressure across altcoins pushed Ethereum and XRP sharply lower.

Prices stabilized on Wednesday, but uncertainty surrounding US monetary policy kept buyers cautious.

The Federal Reserve’s rate decision and subsequent guidance could influence liquidity expectations, Treasury yields, and demand for risk assets. A more restrictive outlook could extend the crypto market’s correction, while a less hawkish message may support a recovery.

Bitcoin maintains bullish EMA structure

Bitcoin continues to trade above its 50-day, 100-day, and 200-day exponential moving averages, which are clustered between approximately $71,400 and $73,600.

The 50-day EMA stands at $73,581, while the 200-day EMA is positioned slightly lower at $73,108. The 100-day EMA provides additional support at $71,391.

This configuration remains constructive because BTC is trading above all three averages and the shorter-term 50-day EMA remains above the longer-term indicators.

However, Bitcoin must defend this support cluster to prevent the recent pullback from developing into a deeper correction.

Bitcoin’s Relative Strength Index has slipped to approximately 49, placing it near neutral territory.

The reading indicates that neither buyers nor sellers have established strong momentum. However, the decline from higher levels shows that bullish demand has weakened following Tuesday’s sell-off.

The Moving Average Convergence Divergence indicator remains negative and below the zero line. This suggests that Bitcoin’s broader bullish structure is still intact, but short-term momentum currently favors consolidation or further downside.

The 50-day EMA at $73,581 represents Bitcoin’s first important support level. If sellers push BTC below that level, the 200-day EMA at $73,108 could provide the next line of defense. A deeper correction would place the 100-day EMA at $71,391 in focus.

Failure to hold the entire moving-average cluster could expose the lower horizontal support levels at $66,500 and $62,300.

On the upside, Bitcoin faces significant resistance near $85,000. A sustained recovery above that barrier would signal renewed bullish strength and potentially restart the broader uptrend.

Key takeaways

• ETH traded near 0.03167 BTC as its performance against Bitcoin weakened.
• A potential double top has formed with two peaks around 0.03344 BTC.
• A close below the 0.03078 BTC neckline could trigger a 10% decline toward 0.0283 BTC.

Ethereum is showing signs of further underperformance against Bitcoin as a potential double-top pattern develops on the ETH/BTC daily chart.

Ether traded near 0.03167 BTC on September 16 after failing to sustain its latest advance. Weakening momentum, growing regulatory uncertainty, and a sharp increase in ETH deposits to Binance support a cautious near-term outlook.

A confirmed breakdown below 0.03078 BTC could send the pair approximately 10% lower toward 0.0283 BTC.

ETH/BTC double top signals potential decline

The ETH/BTC chart has formed two comparable peaks near 0.03344 BTC, with the first appearing in August and the second in September.

This structure resembles a double top, a bearish reversal pattern that develops when buyers repeatedly fail to break through the same resistance level.

The pattern’s neckline sits near 0.03078 BTC. Ethereum would need to record a decisive daily close below this level to confirm the bearish setup.

Subtracting the pattern’s height from the neckline produces a downside target around 0.0283 BTC. Reaching that level would represent an approximately 10% decline from Ether’s current value against Bitcoin.

Ethereum momentum weakens

The ETH/BTC Relative Strength Index has fallen toward 50 after previously moving above the overbought threshold of 70.

Although the RSI remains slightly above neutral, its retreat indicates that the momentum supporting Ethereum’s August-to-September recovery is fading.

Ether is still holding marginally above its 20-day exponential moving average at approximately 0.03162 BTC. A strong rebound from this moving average could delay or prevent the bearish breakdown.

A sustained move above the two peaks at 0.03344 BTC would invalidate the double-top scenario and restore a more bullish relative outlook for ETH.

The bearish technical setup emerged as the US Senate failed to advance the Digital Asset Market Clarity Act on September 15.

The procedural vote received 50 votes in favor and 49 against but fell short of the 60 votes required to move the legislation forward. A procedural vote change by Senator Thom Tillis preserves the possibility of reconsidering the measure.

The setback triggered a wider cryptocurrency sell-off. Bitcoin declined approximately 4% to around $75,900, while shares of major crypto companies, including Coinbase and Circle, also fell.

Regulatory uncertainty can encourage traders to favor Bitcoin over more risk-sensitive assets such as Ethereum. This could increase pressure on the ETH/BTC pair and bring the 0.03078 BTC neckline back into focus.

Binance receives 709,400 ETH in one day

Ethereum deposits to Binance have also increased sharply, creating another potential source of selling pressure.

Approximately 709,400 ETH moved onto the exchange on September 11, marking the highest daily inflow since June, according to CryptoQuant. Several recent sessions also recorded inflows exceeding 500,000 ETH, considerably above typical July and August levels.

Rising exchange inflows increase the amount of ETH immediately available for trading. Although transfers to exchanges do not necessarily mean holders intend to sell, unusually large deposits can precede higher market supply and increased volatility.

The elevated inflows reinforce the cautious outlook created by Ethereum’s weakening relative momentum and the CLARITY Act setback.

ETH/BTC bulls must defend 0.03078

The bearish scenario depends on ETH/BTC closing decisively below the 0.03078 BTC neckline. Confirmation could open the path toward the measured target of 0.0283 BTC.

However, support from the 20-day EMA near 0.03162 BTC could allow Ether to rebound. A break above 0.03344 BTC would invalidate the double top and signal renewed Ethereum strength against Bitcoin.

U.S. spot bitcoin ETFs shed $450 million on Tuesday, according to SoSoValue, the heaviest single-day outflow since June 25, after the U.S. Senate declined to advance the Digital Asset Market Clarity Act.

Bitcoin is little changed since midnight UTC, after dropping following the vote, which garnered around 10 fewer votes than the 60 required. Among those opposing the motion were seven Democrats who had spent months negotiating the text.

The CoinDesk 20 Index also held its loss, dropping less than 0.1% since midnight after falling 4.6% on Tuesday in the steepest decline since June 5.

Attention now switches to the Federal Reserve, which announces its interest-rate decision later today, with an increase having been the market’s base case going into the meeting.

Stellar fell 9.6% over 24 hours and XRP lost 8.1% Among CoinDesk 100 constituents, a full 95 lost value over the period.

We have watched the alternative play out before. When regulators told websites to obtain consent, they specified the goal and not the method, and the market answered with the cookie banner, the pop-up you dismiss a hundred times a week without reading. Crypto built its own version: upload your ID to everyone. A passport copy in a hundred databases, protecting almost no one and enriching whoever breaches the weakest of them.

And this is only the rehearsal. The internet is being rebuilt around software that acts on our behalf, and the familiar sorting of traffic into “bot” or “human” is already breaking down. A third category is emerging: verified agents transacting, with permission, for real people. Those agents will move money, and they will have to prove they are authorized and what they are allowed to do, at machine speed and machine volume. If they inherit today’s model and drag their owner’s full identity through every service they touch, we will not have a handful of honeypots. We will have billions of them, refreshed continuously, that never sleep.

The $320 million will most likely come back. The addresses, the IDs, and the faces will not. The lesson of these weeks is not that we need higher walls around the data we hoard. It is that we are hoarding data we never needed to collect. The technology to prove without surrendering already exists: provable, private, and portable, for people today and for their agents tomorrow. The only question is whether we adopt it before the honeypot becomes the permanent architecture of both.

Security researchers have traced more than 1,500 KREMLIN malware infections after uncovering a Brazilian banking campaign that uses Ethereum smart contracts to update attack infrastructure and malicious browser extensions to steal credentials and session data.

Elastic Security Labs disclosed the operation in a Sept. 14 technical report after tracking the activity under REF9334 since May 2025. Researchers followed seven campaigns over roughly 15 months and linked the latest versions to Chrome and Microsoft Edge extensions capable of collecting browser credentials, cookies, session tokens and other sensitive information.

SlowMist issued a threat-intelligence alert on Sept. 16 drawing attention to the blockchain component of the operation, including three Ethereum contracts linked to changing command-and-control infrastructure.

Despite the name KREMLIN, Elastic said it found no evidence connecting the campaign to Russia. The toolkit name comes from the malware author’s handle, while the lures impersonate Brazilian banks, use Portuguese-language text and overwhelmingly reach systems located in Brazil.

KREMLIN uses Ethereum contracts as changing address books

Ethereum entered the operation in May 2026, when researchers observed the first malicious smart contract tied to KREMLIN’s infrastructure.

Elastic traced the first contract to May 19. It stored configuration values pointing infected systems toward locations used for the installer and malicious browser extension. Later contracts changed the structure and eventually moved to a key-value configuration model that could be updated by the operator.

The current contract identified by Elastic is 0xCD7360A83E5cdbBbbbcEB0e78748babA6740d07b. Researchers said it remained in use when their report was published. Earlier contracts included 0x902EDbFECFF38f285Bf26283fB9cEB3700061873 and 0x64Def0A6099c4DE9C413B108EAae85A3C7457615.

The contracts do not represent an exploit of Ethereum’s consensus system or smart-contract platform. Elastic found that the attackers used the blockchain as a dead-drop resolver: infected machines read configuration values from the contracts to locate external infrastructure controlled or abused by the operators.

Such a design lets operators change infrastructure references by updating on-chain values while leaving the initial malware unchanged. Elastic recorded contract updates pointing toward different domains and hosted files, including a main-v2 configuration change on Aug. 13.

Crypto.news reported in 2025 that malicious npm packages were using Ethereum smart contracts to retrieve command infrastructure. ReversingLabs researchers described a comparable model in which blockchain data contained locations used to reach attacker-controlled servers.

Microsoft found ClickFix campaigns using BNB Chain smart contracts to retrieve malware instructions. Microsoft’s findings involved a separate campaign but showed another example of public blockchains being used as infrastructure for malware configuration.

Malicious extensions can enter Chrome and Edge without approval

KREMLIN’s browser component uses a technique that lets an unauthorized extension appear properly registered inside Chromium-based browsers.

Elastic said the installer modifies Chrome or Edge’s Secure Preferences data and regenerates the HMACs and encrypted integrity hashes the browser expects. Once those values match, the malicious extension can load even though the user never approved an installation through the official extension store.

The technique itself predates the KREMLIN campaign. Security firm Synacktiv documented the approach in 2025 under research titled The Phantom Extension, showing how an attacker with access to a Windows system could alter Chromium preference records and load an extension through internal browser mechanisms.

KREMLIN operationalized that technique for financial theft. Elastic’s analyzed extension masqueraded as software called AVSync and requested access to tabs, cookies, browser storage and web requests. It could collect saved browser data and intercept information during active web sessions.

The malware gathers browser databases containing login information, cookies and stored form data. Elastic found that it acquired encryption material needed to access protected browser data before sending collected information to attacker-controlled infrastructure.

Initial infection still requires execution of a malicious file. Elastic said the campaign distributes JavaScript files disguised as bank receipts, invoices or corporate documents. Once a victim executes the lure, the loader checks the environment before progressing through later stages.

Brazilian financial brands impersonated in campaign material included Banco do Brasil, Caixa, Bradesco, Sicoob, C6 Bank, Inter, BTG, Safra, PagBank, PicPay, Santander and Mercado Pago.

Elastic counted 1,515 infected hosts after disrupting a kill switch

Elastic gained an unusually direct measure of the campaign’s reach after researchers noticed that KREMLIN checked an unregistered internet domain as part of its anti-analysis process.

The malware was designed to test whether the domain responded. A successful response caused the program to assume it was operating inside an analysis sandbox and terminate itself. Elastic registered the previously unused domain and pointed it to infrastructure the researchers controlled.

Infected machines then began contacting the newly registered address. Elastic counted 1,515 systems at the time of publication, with 98.75% geolocated in Brazil. Researchers said the number was rising quickly.

Registering the domain turned KREMLIN’s own anti-analysis check against the campaign. Machines reaching the domain interpreted the response as evidence of a sandbox and stopped progressing through the infection chain.

Elastic cautioned that the intervention was temporary. “This has temporarily degraded and manipulated the campaign’s defense mechanisms,” the researchers wrote, saying the interruption could give defenders more time to locate and clean affected endpoints.

The systems remained infected, meaning the registration did not automatically remove KREMLIN from compromised computers. Elastic’s report said the affected machines had been prevented from moving beyond the relevant infection stage while the canary remained effective.

The geographic data supports the researchers’ earlier assessment that Brazil is the campaign’s primary target. Portuguese-language filenames, fake error messages and Brazilian financial brands appeared repeatedly across the recovered samples.

Ethereum wallet activity links multiple KREMLIN campaigns

On-chain analysis helped Elastic connect different stages of the malware operation. Researchers identified a single Ethereum wallet used to deploy malicious contracts and update their configurations. The address was financially active before the first KREMLIN-linked contract appeared, giving investigators a transaction trail spanning more than a year.

Between June 19, 2025, and Aug. 24, 2026, Elastic identified 82 USDT transfers associated with the wallet. The recorded activity totaled approximately 20,778.97 USDT received and 19,016.96 USDT sent. Researchers said individual transfers could not be conclusively classified as malware-development funding.

Transaction timing provided another attribution clue. Elastic found that much of the wallet activity lined up with working hours in the UTC-3 time zone used by São Paulo, although the researchers presented Brazil as a plausible operator location instead of a confirmed attribution.

The campaign has changed tooling during its lifespan. Earlier waves distributed PULSAR RAT, while the newer Ethereum-linked branch introduced REMCOS RAT alongside the custom browser extension. Elastic identified two related chains during this period, including one that uses a legitimate signed SentinelOne executable as part of the loading process.

Security teams can use the indicators published by Elastic Security Labs and its accompanying public IOC repository to check endpoint, browser and network telemetry for artifacts tied to the campaign. Elastic mapped the activity to MITRE ATT&CK techniques covering execution, persistence, credential access, browser extensions, command-and-control and data exfiltration.

Brazilian crypto users were targeted by separate WhatsApp-distributed malware in late 2025. That campaign targeted banking, fintech and cryptocurrency credentials but was not linked to REF9334.

Elastic’s latest published blockchain timeline shows KREMLIN’s contract configuration being modified through August, while its infrastructure observations extend into late August 2026. The researchers said the 0xCD7360…d07b Ethereum contract remained in use when the Sept. 14 report was prepared.