News

CoinDesk Indices presents its daily market update, highlighting the performance of leaders and laggards in the CoinDesk 20 Index.

The CoinDesk 20 is currently trading at 4148.79, up 1.1% (+45.25) since 4 p.m. ET on Monday.

Nineteen of 20 assets are trading higher.

Leaders: NEAR (+6.7%) and HBAR (+3.1%).

Laggards: BCH (-0.3%) and POL (+0.3%).

The CoinDesk 20 is a broad-based index traded on multiple platforms in several regions globally.

SharpLink Gaming (SBET), a Nasdaq-listed ether (ETH) treasury firm helmed by Ethereum co-founder Joe Lubin, said on Tuesday it has bough back $15 million worth of shares, noting the stock's market cap is below the company's $3.6 billion in ETH holdings.

The Minneapolis-based firm repurchased about 939,000 shares at an average price of $15.98 as part of its share buyback program, according to a press release.

"The Company believes its common stock is significantly undervalued in the market and believes buybacks represent a compelling investment that underscores confidence in its long-term strategy and growth prospects," said SharpLink.

The stock was up 3.6% in pre-market trading on Tuesday alongside this news and more than a 1% rise in the price of ETH since yesterday's close.

SharpLink holds about $3.6 billion worth of ETH with nearly all of its holdings staked, providing an income stream, the firm said. The stock currently trades at a 0.87 multiple of net asset value (mNAV), according to SharpLink dashboard, limiting its ability to raise funds by selling shares for ETH purchases as part of its strategy.

Executives said that the firm has not tapped its at-the-market facility to sell shares while trading below net asset value, noting such moves would dilute ETH holdings per share, a key metric for the firm.

Digital asset treasury firms plunged sharply over the past weeks as crypto markets cooled off. Rival digital asset treasury firm BitMine (BMNR), which holds nearly $9 billion in ETH, also fell below the 1 mNAV threshold.

BMNR and SBET have each decline about 60%-70% since their July highs.

Read more: Asia Morning Briefing: BTC Treasury Demand Is Weakening, CryptoQuant Cautions

A phishing email on Monday took down one of Node.js’s most prolific developers by pushing malicious code into packages downloaded billions of times a week, in what researchers call the largest software supply-chain attack in recent times.

While the scope of the attack is massive, Security Alliance said in a Tuesday report that the attacker walked away with barely a few cents. However, security teams now face the substantial cost of updating backend systems to counter further attacks.

A very popular maintainer whose work (like chalk and debug-js) gets used in billions of downloads every week, known as “qix,” responsible for libraries such as chalk and debug-js, was compromised last week after receiving an email from support@npmjs[.]help. The domain once pointed to a Russian server and redirected to a spoofed two-factor authentication page hosted on the content delivery network BunnyCDN.

The credential stealer harvested username, password, and 2FA codes before sending them to a remote host. With full access, the attacker republished every qix package with a crypto-focused payload.

Node Package Manager (shortened to npm, not NPM) is like an app store for developers and is where coders download little building blocks of code (called packages) instead of writing everything from scratch. A maintainer is the person or entity who creates and updates those packages.

How the attack happened

The injected code was simple. It checked if window.ethereum was present and, if so, hooked into Ethereum’s core transaction functions. Calls to approve, permit, transfer, or transferFrom were silently rerouted to a single wallet, “0xFc4a4858bafef54D1b1d7697bfb5c52F4c166976.”

Any Ethereum transaction with value and no data was also redirected. For Solana, the malware overwrote recipients with an invalid string beginning “1911…,” breaking transfers outright.

Network requests were also intercepted.

By hijacking fetch and XMLHttpRequest, the malware scanned JSON responses for substrings resembling wallet addresses and replaced them with one of 280 hardcoded alternatives to look deceptively similar.

Impact of the attack

But for all the distribution, the impact was negligible.

On-chain data shows the attacker received only around five cents of ether and about $20 worth of an illiquid memecoin that traded less than $600 in volume, the Security Alliance report said.

Popular browser wallet MetaMask also said on X that it was not affected by the npm supply chain attack as the wallet locks its code versions, uses manual and automated checks, and releases updates in stages. It also employs "LavaMoat," which blocks malicious code even if inserted, and "Blockaid," which rapidly flags compromised wallet addresses, to keep such attacks at bay.

Meanwhile, Ledger CTO Charles Guillemet warned that the malicious code had been pushed into packages with over a billion downloads and was designed to silently replace wallet addresses in transactions.

The attack follows another case flagged last week by ReversingLabs, where npm packages used Ethereum smart contracts to conceal malware links — a technique that disguised command-and-control traffic as ordinary blockchain calls.

BNP Paribas and HSBC have joined the Canton Network, a permissioned and privacy-centric blockchain popular with banks and large financial institutions.

Their addition comes after Goldman Sachs, Hong Kong FMI Services and Moody’s Ratings joined in March. The Canton Network hosts more than $3.6 trillion in tokenized assets, according to the foundation. It functions as a permissioned blockchain with a “Global Synchronizer” that allows trades and settlements to occur across different networks without compromising data control.

BNP Paribas said joining reflects its digital transformation strategy and intent to collaborate on blockchain applications in client services. HSBC framed the move as a way to improve liquidity in digital asset markets and support transactions that span multiple assets.

The Canton Foundation counts more than 30 members, including Broadridge, Tradeweb and Digital Asset. By uniting banks, fintech firms and service providers under neutral governance, the foundation aims to create infrastructure for tokenized finance that mirrors the trust and operational standards of traditional markets.

Stellar’s XLM token saw a sharp rally during a 23-hour period between September 8 and 9, advancing 4% from $0.37 to $0.38 on heavy institutional flows. Trading volume surged to 90.25 million tokens at the September 9 breakout, more than double the 24-hour average, according to market data. A Wall Street proprietary trading desk highlighted the move, noting that resistance formed at $0.39 as corporate accounts began consolidating. Analysts described the $0.38–$0.39 range as a zone of institutional accumulation, underscoring growing corporate treasury interest in blockchain-linked assets.

The breakout also set the stage for a low-volatility consolidation period. Between 10:57 and 11:56 on September 9, XLM maintained a tight trading band, opening and closing at $0.38. Market participants said this stability was crucial for corporate treasurers, who often seek predictable price ranges before approving allocations to digital assets. The technical setup, including emerging golden cross patterns flagged by analysis firms, has bolstered the token’s credibility among institutional investors.

Beyond the market action, regulatory developments are shaping how corporate finance teams assess their blockchain strategies. Paxos, fresh off its November 2024 acquisition of Molecular Labs, filed to issue a USDH stablecoin on Stellar’s infrastructure aimed at Hyperliquid’s corporate clients. The move builds on Paxos’s $160 billion track record in stablecoin issuance and highlights the firm’s intent to position Stellar as a regulated payments network for enterprises.

At the policy level, the recently enacted GENIUS Act has drawn criticism from banking associations, who argue its provisions could open doors for exchanges to package stablecoins as investment products. Still, corporate legal departments see the framework as a step toward regulatory clarity. Combined with Stellar’s growing network and Paxos’s proposed USDH stablecoin, the developments could accelerate corporate adoption of blockchain-based cross-border payments.

Technical metrics

• Golden cross technical formation indicates potential long-term institutional accumulation patterns suitable for corporate investment committees.
• Trading volume surge of 85% to $333.21 million demonstrates increased institutional market participation and corporate treasury interest.
• Price breakout above $0.38 resistance with volume confirmation meets institutional risk management criteria for digital asset exposure.
• Support levels established at $0.37-$0.38 provide corporate treasurers with defined risk parameters for position sizing.
• Consolidation phase between $0.38-$0.39 suggests institutional accumulation strategies ahead of potential corporate adoption announcements.
• High-volume resistance at $0.39 requires additional institutional buying pressure, indicating measured corporate adoption pace.

Disclaimer: Parts of this article were generated with the assistance from AI tools and reviewed by our editorial team to ensure accuracy and adherence to our standards. For more information, see CoinDesk's full AI Policy.