SEC Clarifies Crypto Rules; Bitget Resumes Withdrawals After $388M Hack

The US Securities and Exchange Commission has published updated guidance clarifying when certain crypto assets and transactions may fall outside federal securities laws. The new FAQs expand on the SEC's March interpretation of how the Howey test applies to digital assets, covering token buybacks, network development, and staking receipt tokens. According to the agency, buybacks may not constitute the managerial efforts associated with an investment contract when a crypto network is already functional and lacks a central party. Work to maintain or improve a functioning network may also fall outside that standard, while staking receipt tokens would not automatically be treated as securities. While the guidance is non-binding and does not change existing law, it gives crypto projects more detail on how SEC staff intends to apply current securities rules, arriving days after the Senate failed to advance the CLARITY Act.

Crypto exchange Bitget is resuming withdrawals after a security breach affecting nearly $388 million in assets, as the attacker continues moving stolen funds through cross-chain protocol THORChain. CEO Gracy Chen confirmed during a Monday ask-me-anything session that Bitcoin withdrawals on both the Bitcoin network and BNB Smart Chain resumed first, with Ether and Tether withdrawals set to follow in the coming days. The Sept. 24 incident compromised part of Bitget's hot and warm wallet infrastructure, while its cold wallets remained secure, according to the exchange. Bitget later revised the stolen amount upward from $351.6 million to $387.5 million after accounting for additional transfers on Zcash and Tron, highlighting ongoing vulnerabilities in centralized exchange wallet systems.

The regulatory update and the Bitget incident together underscore the dual pressures shaping the crypto industry in 2026: regulators working to clarify jurisdictional boundaries while exchanges continue to face sophisticated security threats. The SEC's guidance parallels similar moves by the Commodity Futures Trading Commission, with both agencies advancing digital asset oversight under their existing authority while the CLARITY Act remains stalled in Congress. Meanwhile, the use of THORChain by the Bitget attacker to swap stolen ETH illustrates how decentralized liquidity protocols are increasingly leveraged to launder proceeds from exchange exploits.