All Blogs

We look at United States regulatory updates in September 2026, including the results of the CLARITY Act votes, updates on tokenized stocks, market structure guidance by the CFTC, and more.

reparing for a Web3 penetration test? Here’s what happens before, during, and after an engagement, and how to get the most value from yours.

On October 6, 2026, at 06:13:11 UTC, an attacker drained 200 ETH ($542,982 at the time of the exploit) of ETH-A collateral from a legacy auction-keeper contract on Ethereum mainnet. The 200 ETH came from four 50 ETH lots that the keeper won with zero bids during MakerDAO's "Black Thursday" liquidations in March 2020 and never settled. An unauthenticated function on the keeper let the attacker give a contract it controlled full delegation over the keeper's MakerDAO Vat account. In a single transaction, the attacker settled the old auctions and withdrew the collateral.

Kyrgyzstan’s central bank is developing a digital version of its national currency, the Digital Som. On 9 September 2026, it signed a Memorandum of Understanding with CertiK, the largest Web3 security services provider, on Digital Som security and broader digital asset oversight. The partnership spans security assessment, formal verification, operational resilience, and ongoing risk monitoring, connecting technical security with longer-term risk management and regulatory oversight.

CertiK’s formal verification of zkWasm provides mathematical proof that a leading zero-knowledge virtual machine executes programs correctly — a rigor level beyond traditional audits, now validated for ACM CCS 2026.

CertiK joins LF Decentralized Trust to bring formal verification and security expertise into the open-source infrastructure enterprises are building on amid intensifying global regulation.

As I wrap up a three-day DC roadshow coordinating Capitol Hill and agency roundtables for the US/UK Crypto Alliance, one conclusion stands out above the rest: the narrative surrounding digital asset policy in Washington has fundamentally shifted.

Circle’s Arc mainnet is scheduled for September 16, 2026, using USDC for gas and settlement while connecting stablecoin scale with institutional and programmable financial activity.

CertiK signs an MoU with the National Bank of the Kyrgyz Republic to advance Digital Som security, AML/CFT oversight, and digital asset supervision.

Red team vs. pentest vs. bug bounty for Web3 projects: what each one actually tests, when to use which, and how to combine them into one program.

Chain Scan brings together automated static code scanning, analyst validation, and controlled runtime testing, with coverage tailored to the agreed scope. It helps identify code-level weaknesses and evaluate how DLT systems behave under adversarial inputs, resource pressure, infrastructure failures, and operational changes.

This article examines how crypto wallets must extend security controls across key generation, recovery, transaction review, and incident response as they evolve into execution environments.