Crypto Law Brief: The SEC’s 760-Page Custody Rewrite, Treasury’s $10 Billion Stablecoin Line, and a $3.8 Million Exploit at NEAR Intents

Two federal agencies moved on crypto rulemaking within two days of each other, a cross-chain platform that spent last week freezing other people's stolen funds became a victim itself, and a $1 billion XRP treasury cleared its last hurdle before Nasdaq. Here is what changed between September 30 and October 2.

The SEC Opens a Narrow Door to Self-Custody

On October 1, the SEC released a 760-page proposal rewriting how investment advisers and registered funds may custody crypto assets under the Investment Advisers Act of 1940 and the Investment Company Act of 1940. The headline provision permits self-custody, which here means the adviser holding client keys rather than the end investor, as Commissioner Hester Peirce moved quickly to clarify. It is available only where no permitted custodian exists for the asset, the adviser can demonstrate expertise, and it reviews quarterly whether a qualified custodian has become available. The proposal also opens the qualified custodian category to state-chartered trust companies, addressing a real bottleneck for institutions that want direct holdings instead of ETF exposure.

Read the burden buried in "limited circumstances." A self-custody decision is a documented judgment call, revisited quarterly, that an examiner will later evaluate with hindsight and a loss on the books. Comments are due 60 days after Federal Register publication.

Treasury Draws the Stablecoin Line at $10 Billion

On September 30, Treasury published its first binding rule under the GENIUS Act, an interim final rule effective on publication that establishes procedures for the Stablecoin Certification Review Committee. Chaired by the Treasury Secretary alongside the heads of the Federal Reserve and the FDIC, it decides whether a state's stablecoin regime is "substantially similar" to the federal standard. The operative number is $10 billion: issuers at or below that consolidated outstanding issuance may pursue state certification, while those above must move to the federal framework within 360 days absent a waiver, which puts Tether and Circle outside the state route. Comments close November 30, 2026, and the first certification deadline is January 18, 2028. One wrinkle matters practically: the committee cannot accept applications until the Office of Management and Budget grants Paperwork Reduction Act approval, so no state can file today however ready its regime is.

NEAR Intents Loses $3.8 Million a Week After Blocking $50 Million

On October 1, NEAR Intents disclosed a roughly $3.8 million exploit traced to a bug in how its Omni deposit and withdrawal infrastructure interacted with the NEAR Intents smart contract. Attackers drained a hot wallet on BNB Chain before the flaw was patched, and withdrawals were frozen across eleven networks for about twelve hours. The platform pledged full reimbursement and called in law enforcement. A week earlier it had intercepted more than $50 million tied to the September 24 Bitget breach. For users, the legal lesson is narrower than the irony: a reimbursement pledge is a public statement, not a contractual obligation, and its scope and timing are set by the platform unless an agreement or a regulator says otherwise.

Evernorth Clears Its Vote for a $1 Billion XRP Treasury

Also on October 1, shareholders of Armada Acquisition Corp. II approved its combination with Evernorth, clearing the way for a Nasdaq listing under ticker XRPN expected October 8. It raised roughly $300 million in gross cash proceeds and holds about 347 million XRP, projected to reach 473 million at closing, with backers including Ripple, Pantera Capital, Kraken, and SBI Group. Treasury companies carry risks that holding the token directly does not: shares can trade at a premium or discount to the underlying, and the issuer takes on public-company disclosure duties regarding an asset whose regulatory classification is still being litigated.

What This Means for You

If you advise clients on digital assets, the SEC proposal is this month's reading, because the comment window is the only part of the process you can influence. Funds should inventory which holdings no qualified custodian supports, since that is what any self-custody analysis turns on. Stablecoin issuers should know which side of the $10 billion line they sit on. Investors eyeing a vehicle like XRPN are buying equity in an operating company, not the token.

Each development shifts where responsibility lands. Self-custody moves safeguarding duty onto the adviser, with the liability that follows. State certification determines which regulator examines an issuer and under what standard. And a reimbursement pledge after an exploit is no substitute for a claim; victims who wait for a make-whole program that narrows or stalls can find limitations periods and tracing opportunities have run.

At Coin Counsel, we work with individuals and businesses navigating the legal fallout of crypto fraud — whether you're a victim seeking recovery, a company facing regulatory scrutiny, or a project working to stay compliant in an increasingly complex legal landscape. The rules are evolving fast, and the cost of getting it wrong has never been higher. Contact us at coin-counsel.com to speak with a crypto-focused attorney today.

Disclaimer

This blog post is for informational purposes only and does not constitute legal advice. Reading this content does not create an attorney-client relationship between you and Coin Counsel or Franco Law PLLC. The legal landscape surrounding cryptocurrency is rapidly evolving and varies by jurisdiction. Do not act or refrain from acting based on information in this post without first consulting a qualified attorney. If you believe you have been the victim of crypto fraud, contact us at coin-counsel.com for a consultation.