The week did not need a new all-time high. It needed licenses, fund wrappers, a withdrawal queue and a phone patch.

Coinbase finished the U.S. derivatives stack. On September 28 the CFTC registered Coinbase Clearing LLC as a derivatives clearing organization, limited to fully collateralized futures, options on futures and swaps. That sits next to Coinbase’s existing DCM and FCM. Leveraged books and planned single-stock perps stay with outside clearers. Coinbase calls the house USDC-native and built for 24/7 settlement — marketing language the Commission order does not itself use. The practical point is narrower and still large: Coinbase can now list, broker and clear prepaid contracts without renting another firm’s default fund.

Citi made the stablecoin invisible to the treasurer. The same day Coinbase and Citi widened an October 2025 pact. Spring by Citi lets institutional merchants take stablecoin at checkout; Coinbase converts; Citi settles fiat. The other way, Coinbase Virtual Accounts sit on Citi’s Virtual Account Wallet: incoming ACH, wire or RTP becomes USDC automatically. Some coverage put a 3.75% platform reward on those USDC balances — Coinbase’s incentive, not Circle’s issuer yield. U.S. first. The treasurer never has to hold a token. That is the product.

Goldman put a $100 billion Treasury fund on a crypto settlement rail — without tokenizing it. FTIXX (Financial Square Treasury Instruments Fund, about $100–$105 billion) is now reachable for qualified U.S. firms on Lynq, with tZERO Securities as broker-dealer. Shares are the ordinary institutional class, not a new on-chain share class. Idle cash between trades can earn Treasury money-market yield and redeem when the next ticket hits. Lynq already ran desks such as Wintermute, Galaxy, FalconX and Crypto.com. BlackRock’s BUIDL and Franklin’s BENJI tokenized the fund. Goldman put the existing fund where crypto firms already settle.

The treasury companies kept buying. Strategy disclosed 1,665 BTC for $142.7 million ($85,681 average) in the week through September 27, taking the stack to 847,666 BTC — more than 4% of the 21 million cap — funded by a $246.2 million MSTR ATM that also retired $151.7 million of STRC. Bitmine Immersion added 17,362 ETH (about $47 million at its $2,698 mark) and crossed 6,001,302 ETH, or 4.9% of stated supply. 5,067,309 of that is staked; Lee’s run-rate on recent yield was about $358 million annualized. One firm is a bitcoin holding company. The other is trying to own a rounding error of Ethereum and stake most of it.

Bitwise listed the first U.S. spot NEAR ETF. NRR opened September 29 on NYSE Arca, 0.75% fee, in-house staking with rewards to NAV (network yield cited near 5%; not guaranteed; fees eat a slice). Debut prints in some tallies: about $35.5 million net inflows and $15 million of volume. Bitwise sold it as an AI-agent settlement layer. Brokerage accounts do not have to care. They just got another single-asset crypto wrapper with a staking kicker.

Bitget opened the doors after a $387.5 million hole. Phased withdrawals started September 28 at 08:00 UTC with bitcoin. Ether followed September 29; USDT September 30; the rest, fiat and P2P are slated for October 2. Chen said the protection fund was back above $300 million and PoR prints were over-collateralized. The exploit itself — spoofed backend into hot/warm wallets, keys not stolen, cold and Bitget Wallet untouched — remains the year’s largest reported exchange theft. Cross-chain screens and intent layers (including NEAR-related flow blocks cited around $50 million of tainted value in market recaps) are the recovery subplot. A queue that pays out is the only proof that matters now.

Chainlink shipped CCIP 2.0 into a bridge scare. The September 28 upgrade adds institution-run Cross-Chain Verifiers so a bank or a hired shop (Infosys, Nethermind) can second-guess the default 16-node committee. The design answer is the April $292 million Kelp/LayerZero-adjacent drain attributed to Lazarus — a single-verifier failure class. Aave had already made CCIP its default; billions rotated off rival rails. Swift access-layer work sits on Chainlink’s CRE, still in the “will be able to” tense, with tokenized-deposit pilots. LINK led large-caps on the week. Trust layer first, fee print later.

Apple patched a zero-day that wallet shops treated as a seed-phrase problem. CVE-2026-86950 in CoreGraphics — out-of-bounds write, arbitrary code — shipped in iOS/iPadOS 26.7.1 and matching macOS updates on September 28. Apple said it may have been used in an “extremely sophisticated” targeted attack on pre-iOS 27 devices; Meta Product Security reported it. Apple did not name wallets. SlowMist said the hole sits next to iOS activity aimed at Keychain, keys and seeds, and pointed at earlier FomoPeek thefts. Install the patch. Do not wait for Apple to write the word “bitcoin.”

The through-line

None of these items required bitcoin at $87,000. They required a CFTC order, a bank virtual-account API, an un-tokenized Treasury fund on a permissioned chain, two corporate 8-Ks, an NYSE Arca ticker, an exchange that could pay withdrawals, a second verifier on a bridge, and a CoreGraphics bounds check. That is what institutional crypto looks like in the week after CLARITY died and the Fed hiked: not a statute, a stack. The stack still has a hacked hot wallet and a phone exploit. It also has Coinbase clearing its own prepaid futures and a treasurer who never sees the USDC. Both sentences are the week.