SlowMist said on Sept. 22 that TraderTraitor, a threat group linked to North Korea and also tracked as UNC4899 and Jade Sleet, has launched another campaign. The group recently compromised an India-based IT services company that was not part of the crypto sector, showing that its targeting has widened beyond crypto-native firms. According to SlowMist, the attackers used fake job postings on GitHub and lured DevOps and crypto engineers with what appeared to be a technical interview assignment. After a victim downloaded the project, a malicious .terraform.lock.hcl file pointed to a Terraform Provider domain controlled by the attackers. Running terraform init then triggered the download and execution of a malicious Provider module. The attack ended with the deployment of the Rust/ARM64 backdoors FLATROOF and ROOFDECK on the victim’s macOS device. SlowMist said both malware families had also been used in the LayerZero attack. The tools can steal credentials and sensitive data, run shell commands, collect and exfiltrate files, and obtain access to cloud services and code repositories. SlowMist warned that the group may now be focusing more on developers’ cloud and API access, including AWS, GCP, OVH and OpenStack.

CoinsBee, a global crypto gift card platform, said payment data from the 90 days ending Sept. 1, 2026 showed USDT on the TRON network as the most-used on-chain payment option on its platform. By transaction count, TRON-based USDT payments were about 1.8 times Bitcoin and 1.9 times Ethereum. Within USDT payments on CoinsBee, TRON accounted for 44.6% of payment count and 64.5% of transaction value, indicating a higher average transaction size. The company also said TRON-based USDT increased its share of total CoinsBee payments to 16.23%, up from 9.92% in 2025, a rise of 64%. During the same period, the brands most frequently purchased by U.S. users through TRON-based USDT included Amazon, Apple, AT&T, PlayStation, and Uber, spanning retail, mobile services, gaming, and food delivery. CoinsBee and TRON DAO plan a joint promotion from Sept. 21 to Oct. 5, offering a 2% discount for users who pay with USDT on the TRON network.

Trader YokaiCapital said on Sept. 21 that multiple projects, KOL accounts and trading platforms in the Solana meme ecosystem may be tied to bundled trading, fake wallets and trade manipulation. The post named accounts including Frank DeGods, Shadow, theunipcs and blknoiz06, and claimed that tokens such as TROLL, ANSEM and CATE showed signs of large numbers of bundled wallets or holders with no real ownership. YokaiCapital also alleged that some KOLs used those tokens and fake accounts to manufacture trading activity. The post went on to question the FOMO leaderboard, saying it contained many fake identities and fake PnL records, with some wallets possibly linked to bundled tokens. It also criticized wallet-tracking and Bubble Maps data shown by Axiom and Pump.fun, and urged users to verify wallet relationships on-chain through tools such as Solscan. YokaiCapital further raised accusations related to Axiom’s data privacy and project listing fees, while also saying that the trader had personally participated in some projects in the past and had taken losses. BlockBeats noted that all of these claims reflect YokaiCapital’s own allegations and views. The original post did not provide enough evidence to independently verify all of the accusations, and whether the named projects, platforms and accounts engaged in the alleged conduct remains unconfirmed.

SlowMist said in a Sept. 20 report that FomoPeek, an on-chain monitoring app distributed through Apple’s App Store, included two malicious modules in versions 1.1 and 1.2 that could remotely fetch instructions, attempt kernel exploits, escape sandbox restrictions, decrypt Keychain data and collect information from other apps. The security firm said the case began after multiple users reported stolen assets and private key exposure, with some of the affected users having used those two versions before the thefts. According to the report, FomoPeek presented itself as a standard crypto tracking product. It had an App Store listing, a website, and an official X account, and marketed itself as a read-only whale tracker for Solana, Ethereum and TRON wallets that did not require seed phrases or wallet connections. SlowMist said its isolated testing retrieved a collection list covering 19 wallet and note-taking apps and captured an uploaded archive containing Apple Notes data. The report also traced one main attacker address analyzed by MistTrack. SlowMist said the address had been active since Sept. 15 and had received a cumulative 579,984.34 USDT by the time the report was published. Funds touched Ethereum, BNB Chain and Arbitrum, with part of the flow moving through FixedFloat and KuCoin. SlowMist advised users who had run FomoPeek 1.1 or 1.2 to treat related seed phrases, private keys and credentials as compromised and migrate assets on a separate trusted device.

Morph Payments, the stablecoin payments platform under Morph, has added support for Solana and TRON. On Solana, the platform now supports USDC and USDT, while on TRON it supports USDT. The update also introduces a new payment option that lets users pay Morph Payments merchants directly from exchange accounts or compatible wallets, while merchants can continue tracking those transactions through the Morph Payments Dashboard. Morph Payments launched in August this year as a non-custodial stablecoin payments platform built for small and medium-sized merchants, freelancers, and cross-border operating teams. The company also said it has upgraded the Morph Payments Help Center alongside the rollout to provide merchants and payers with guidance on platform usage and product features.

Ethena has generated $1.04 billion in cumulative revenue since launch, including $284 million over the past 12 months, yet ENA holders have not received any direct economic benefit so far. That could change after a Sept. 2 governance vote approved a fee switch tied to USDe supply. Once the 14-day average supply of USDe rises above $7.5 billion, 95% of the revenue routed through the switch will be used to buy ENA on the open market. USDe currently stands at $4.75 billion, still 58% below the threshold. The original article argues that the gap could close within three to six months, driven by three factors: stock perpetuals as a new source of funding-rate income, a recovery in crypto perpetual funding rates, and broader distribution through TRON, centralized exchange collateral integrations, and Ethena Pay. The piece also lays out the mechanics of the buyback program, with revenue-sharing tiers at $7.5 billion, $10 billion, $15 billion, and $20 billion in USDe supply. It highlights several risks as well, including an Oct. 5 token unlock, the possibility of funding rates turning negative again, weaker-than-expected stock perpetual adoption, credit or lending losses in reserve allocations, and the chance that USDe never clears the $7.5 billion mark.

Ethena is drawing fresh attention not simply because it launched another crypto card, but because Ethena Pay routes user deposits into USDe, giving the protocol both a consumer payments entry point and exposure to the underlying income generated by its own stablecoin system. That structure sets it apart from many crypto neobanks, where a large share of the economic value tied to customer balances is captured by third-party stablecoin issuers rather than the app distributing the product. The second change is on the token side. With Ethena’s fee switch now approved, growth in USDe supply has a clearer path to ENA buybacks, though the mechanism has not started yet. Under the governance plan, buybacks begin only after USDe supply reaches $7.5 billion, with a 5% take rate at that first threshold and higher extraction rates at $10 billion, $15 billion, and $20 billion. The model remains early. As of Blockworks’ Sept. 15 report, Ethena Pay had reached roughly $250,000 in weekly card spending, 456 funded accounts, and about $4.3 million in balances, while USDe supply stood near $4.6 billion. The core questions are still execution-related: whether Ethena Pay can scale beyond an invite-only product, and whether USDe can grow enough to push ENA’s buyback framework from governance design into live operation.

A packed calendar is lined up for Sept. 21-27, with several crypto market deadlines and product changes already scheduled. Moscow Exchange is set to launch crypto index perpetual futures tied to BTC, ETH, SOL, XRP and TRX on Sept. 22, offering cash-settled contracts priced in U.S. dollars and settled in rubles for qualified investors only. The same day also marks the deadline for The Sandbox’s SAND compensation claims tied to the Aug. 22 Base and BNB Chain bridge attack, while Zilliqa is expected to trigger its second exchange migration hard fork. On Sept. 23, BitMEX is due to shut down at 12:00 Beijing time after halting new user registrations, with remaining positions to be forcibly closed after the deadline. Sept. 24 brings another set of changes: Phantom will stop supporting Sui, Binance will delist all USDP spot pairs, and Coinbase will suspend trading in IoTeX (IOTX) across several services. On Sept. 25, oracle project Switchboard plans to end operations and terminate remaining support, while Binance Futures is scheduled to list next-quarter 0326 delivery contracts. The week also includes a series of public appearances by Federal Reserve officials, including John Williams, Philip Jefferson, Austan Goolsbee and Thomas Barkin.