This Week in Crypto (September 28–October 5): A Senate Report Traces Iran's Money to USDT, 29,000 Jobs Price Out the October Hike, and Zano Rewinds a Month of Its Own Chain

If last week was about how money leaves an exchange, this week was about who gets to move it in the first place. A Senate report linked USDT to Iran's sanctions evasion, followed three days later by Treasury action against Russia's A7 payments network. The SEC proposed allowing advisers to self-custody crypto, while community banks sued to challenge the expansion of crypto-related trust charters. Friday's weaker-than-expected jobs report pushed expectations for an October rate hike lower and sent bitcoin above $87,000. Here's what happened, story by story.

The week at a glance

Washington traced Iran's money to USDT, then targeted Russia's A7 network

On September 28, Democratic staff of the Senate Permanent Subcommittee on Investigations released a report examining 846 wallets sanctioned for links to Iran and its proxies. According to the report, 84% transacted exclusively or almost exclusively in Tether's USDT. Two sanctioned oil smugglers moved more than $603 million in USDT between 2021 and 2025.

The report highlights a gap between sanctions designation and enforcement. Before 2024, Tether did not consistently freeze designated wallets, and in one case, $34.6 million continued moving after a wallet was designated. Sen. Richard Blumenthal called on Treasury and the Justice Department to investigate. Tether responded the same day.

On X: @tether — Tether says it has supported "nearly $550 million in Iran-linked USD₮ freezes."

On October 1, Treasury designated the A7 Network as a significant transnational criminal organization. A7 is a Russia-linked payments system built around A7A5, a ruble-backed token. Treasury says the network was used by Iran to evade sanctions. A7 had reported transaction volume of approximately 7.5 trillion rubles, or $91.5 billion. FinCEN also proposed blocking transfers through A7's third-country sub-agents.

On X: @USTreasury — calls it "unprecedented action against the A7 Network, a shadow banking network."

Both actions target the same pressure points: stablecoin issuers that can freeze tokens and the intermediaries that move money between parties. Our stablecoin explainer explains why stablecoins can include freeze functions in the first place.

29,000 jobs pushed the October hike off the table, and bitcoin hit $87,000

September payrolls, released on October 2, added just 29,000 jobs, well below expectations of roughly 84,000. Unemployment rose to 4.2%, while August's job gains were revised down to 133,000. CME FedWatch put the odds of the Fed holding rates at its October meeting at 84%. That was a sharp reversal from the previous week, when a spike in Treasury yields had pushed the odds of a hike above 70%.

On X: @JustinWolfers — described the report as "weak -- but not tragic," with payrolls averaging about 17,000 a month over three months.

Treasury yields fell alongside rate expectations. The 10-year yield dropped nearly six basis points to 5.18%, while the 2-year fell to 4.73%. Bitcoin, which had tested the $82,500 support level three times during the week, broke through a sell wall at $85,000 and climbed above $87,000 on Friday. That put it 14.6% above its September 15 low. By Sunday, it had settled near $85,200.

There is still room for caution. Goldman Sachs Asset Management continues to view a December rate hike as its base case, suggesting the jobs report may have delayed the move rather than ruled it out. ETF demand is also cooling: spot bitcoin funds attracted $2.65 billion in September, down from $3.52 billion in August.

The SEC moved to expand crypto custody options as community banks challenged trust charters

On October 1, the SEC proposed a new custody framework for registered investment advisers and funds. Under certain conditions, advisers could self-custody crypto assets, while state trust companies could also serve as custodians. The proposal includes a 60-day public comment period beginning with its publication in the Federal Register.

On X: @SECPaulSAtkins — Atkins says custody rules "have not kept pace" with a multi-trillion-dollar asset class.

The following day, the Independent Community Bankers of America (ICBA) sued the Office of the Comptroller of the Currency (OCC) in federal court in Washington. The lawsuit challenges the OCC's March 2026 chartering rule, Interpretive Letter 1176 from 2021, and the agency's approval of Protego's charter.

On X: @GivnerAriel — an attorney's summary of the complaint puts the number at 21 approved trust banks, 13 of them crypto firms.

The figure of 21 approved trust banks, including 13 crypto firms, comes from one lawyer's interpretation of the complaint and should be treated as unconfirmed. The OCC declined to comment.

On the SEC side, Commissioner Hester Peirce emphasized that "many crypto owners prize being able to custody their own assets." Individuals can already choose to manage their own keys. That distinction between control by a third party and direct ownership is central to both developments. Our custodial vs. non-custodial guide explains how the two approaches differ.

Blast, once a $2.2 billion layer-2, is shutting down

On October 2, Blast announced plans to wind down its Ethereum layer-2 network. Its total value locked (TVL) peaked at $2.2 billion in June 2024 but has since fallen to approximately $32 million, a decline of 98.5%.

On X: @blast — "the ongoing costs of maintaining Blast exceed the revenue generated by the L2."

The decline reflects the challenges Blast faced as competition intensified. The project raised $20 million from Paradigm and Standard Crypto and launched with a focus on native yield. But it struggled to maintain its position as Base and Robinhood's own layer-2 offering entered the market with access to established user bases. BLAST fell 17–19% following the announcement.

Withdrawals will be paused for approximately one week while Blast withdraws its Lido assets, then resume with a 24-hour delay. The standard interface will remain available until October 26. After that, users will need to claim their funds directly through the layer-1 bridge contracts.

If you hold assets on Blast, consider moving them before the deadline. Our bridge explainer explains how cross-chain transfers and exits work.

The kicker: Zano rewound a month of its own chain to erase $200 million in counterfeit tokens

On August 29, an attacker exploited a missing validation check in Zano's new Gateway Addresses feature to mint approximately 18.4 million ZANO, worth around $102 million at the time, in a single transaction. The exploit went unnoticed for nearly a month.

On September 25, the attacker repeated the exploit using ZANO and the fUSD stablecoin. Zano's monitoring systems finally detected the activity, bringing the total value of counterfeit tokens to more than $200 million.

The recovery plan involved restarting the chain from block 3,833,000, before the hard fork that introduced the vulnerability. That decision erased an entire month of legitimate transactions, staking rewards, and mined blocks alongside the counterfeit tokens.

Freedom Dollar said several million dollars' worth of its assets had been exchanged for counterfeit fUSD. Zano says affected users will be reimbursed using funds from its development fund and team, without issuing additional ZANO. Critics argue that the rollback effectively spread the cost of the exploit across everyone who used the chain during that month.

Also this week

• Bitget restored all withdrawals on October 2, as scheduled. The attacker has been swapping ETH for BTC through THORChain, which declined Bitget's request to block the addresses. THORChain said a network-wide halt "is not a selective freeze."
• Drift opened recovery claims covering just over 1% of losses. The recovery pool holds $3.11 million against the $295.4 million April exploit. Tether's pledge of up to $127.5 million has yet to arrive.
• Circle and the Hyperliquid Policy Center urged the EU to revisit its stablecoin and derivatives rules on October 1. Their request targeted MiCA's stablecoin-reserve and perpetual-futures provisions and came one day after ESMA published its own MiCA recommendations.
• The UK FCA opened applications for crypto authorization on September 30. The application window runs through February 28, 2027, ahead of the new regime's launch on October 25, 2027.

What to watch next

Four dates stand out over the coming weeks: October 6, when Glamsterdam moves to the Sepolia testnet; October 19, when CME launches BCH and UNI futures; October 26, Blast's withdrawal deadline; and the October FOMC meeting, where markets currently price an 84% probability of no rate change.

Also watch for Bitget's post-mortem and any response from Treasury to the Senate report on Tether. This week's events are another reminder to understand who controls your assets and private keys. Coin98 Super Wallet generates keys on-device and supports more than 100 chains. For more context on the Bitget incident, see last week's roundup.

Last updated: October 2026