Cryptoccino An espresso cup on a saucer with a folded newspaper, beside the Cryptoccino wordmark and tagline. Cryptoccino YOUR DAILY SHOT OF CRYPTO NEWS
Weekly Recap Cryptoccino TV Buy me a coffee
Theme

Cryptoccino — Saturday 26 September 2026

☕ 8 min read

Today's Roast

Single shot · top move 3.3% (SOL)

The Pour. A $387 million exchange heist, a stablecoin freeze that caught almost nothing, and crypto’s loudest regulator heading for the exit.

Today. Bitget’s $387M hack: spoofed transfers, North Korea fingerprints, and a freeze that locked $318K Security Desk · Hester Peirce departing the SEC next week On the Hill · Bitcoin ETF flows turn net positive for 2026 after erasing $5.8B deficit Markets.

Prices

  • BTC$83,889−0.2%
  • ETH$2,686+0.4%
  • BNB$774+0.1%
  • SOL$120+3.3%
  • XRP$1.55+1.6%
  • DOGE$0.0978+2.6%

SECURITY DESK

Bitget Loses $387M to Spoofed Internal Transfers as North Korea Shadow Looms

decrypt coindesk coindesk decrypt cryptobriefing

Fear & Greed74/100Greed +3 / 7d

What happened. An attacker drained $387.5 million from Bitget’s hot and warm wallets by faking internal transfer requests rather than compromising private keys. CEO Gracy Chen said the method bears the hallmarks of Lazarus Group, though attribution remains unconfirmed. The hacker has since pulled $1.23 million from Binance and routed funds to attacker-controlled wallets.

Why it matters. This is the largest single exchange hack of 2026 and the first prominent case where spoofed internal transfers, not key exfiltration, served as the primary attack vector. It signals that operational security around internal settlement logic is now as critical as cold-wallet hygiene. The Fear & Greed Index sits at 74 (Greed), which means most of the market is not pricing in what a state-level actor running systematic exchange raids actually looks like at scale.

The catch. Circle and Tether moved to blacklist a wallet labelled ‘Bitget Exploiter 8’, but between them froze only around $318,000 in stablecoins. The attacker had already swapped the bulk of funds into ETH, which neither issuer can touch. Separately, the Bitget CEO herself disclosed an $80,000 personal loss from a Lazarus-linked fake interview scam, raising questions about the firm’s internal threat-awareness before the main event.

Markets

Bitcoin ETF flows flip positive for the year. US spot Bitcoin ETFs have collectively erased a $5.8 billion net outflow hole accumulated through early 2026, turning the year-to-date figure positive. The reversal coincides with BTC consolidating near $84,000 while a $15.6 billion options expiry passed without a sharp move. Altcoins outperformed through the session, with XRP and Solana extending gains as BTC held its range. coindesk decrypt

Bond vol spikes while crypto stays unmoved. Treasury volatility surged on the session while Bitcoin and equity indices shrugged it off, a divergence that on-chain analysts say looks less like calm and more like disengagement. River data shows 81% of BTC supply has been inactive for at least six months, suggesting holders are not distributing into strength the way prior cycle tops played out. coindesk cryptobriefing

Strategy proposes 365-day dividend accrual across all four preferred stocks. MicroStrategy parent Strategy is asking shareholders to approve daily dividend accrual on STRC, STRD, STRF, and STRK, including weekends and holidays. The move is framed as a volatility dampener for STRC, which has drifted below its $100 par value. Strategy also surpassed Palantir in daily US trading volume to become the 20th most-traded stock in the country. coindesk theblock decrypt cryptobriefing

CFTC charges Cash FX Group in a $950 million fraud scheme. The CFTC filed charges against Cash FX Group S.A., its CEO, and three associates over an alleged $950 million fraud targeting retail participants. The case adds to a busy enforcement quarter for the commodities regulator and arrives as several firms are simultaneously seeking CFTC approval for single-stock perpetual futures products. cftc_enforcement

Projects & Money

Aave V4 on Base accepts tokenised stocks as USDC collateral. Apple, Nvidia, Tesla, and four other Coinbase-issued tokenised equities are now live as collateral for USDC loans on Aave V4, available to non-US users. The integration is one of the more concrete uses of tokenised stocks in live DeFi rather than proof-of-concept wrappers. Ethena is moving in a similar direction, adding Binance bStocks and equity perpetuals to the basis trade backing USDe. theblock theblock

KelpDAO sues LayerZero over the $292 million rsETH exploit. Developer entity Evercrest filed suit against LayerZero and CEO Bryan Pellegrino, alleging the bridge’s single-verifier configuration was approved in writing multiple times before the April 18 attack drained $292 million from rsETH. The complaint claims LayerZero later warned a separate developer about the same flaw without notifying KelpDAO. CoinDesk has characterised it as the largest exploit of 2026 so far. theblock coindesk decrypt

BlackRock deepens its Ondo tokenisation partnership. BlackRock is extending its tokenised asset collaboration with Ondo Finance, adding further institutional weight to the on-chain RWA stack. Separately, 86% of real-world asset perpetual volume is now trading on-chain according to new data, a figure that was negligible two years ago. Circle’s cirBTC wrapped Bitcoin token has also crossed 5,000 tokens issued, up from roughly 40 in mid-August. decrypt cryptobriefing cryptobriefing

Zano halts all economic activity after an inflation bug, plans a chain rollback. Privacy coin Zano suspended transfers and staking after discovering a bug that allowed illegitimate token minting, inflating supply beyond protocol parameters. The team is planning a rollback, which will be among the more significant chain reversals for a live network this year. AlphaFi, a SUI-ecosystem yield protocol, is also reportedly winding down following an oracle misconfiguration, with the SUI Foundation’s role in the decision remaining unclear. cryptobriefing cryptobriefing

Security Desk

Bitget hack: full Security Desk write-up in the lead above. See the lead story for the complete picture on the $387 million spoofed-transfer attack, the stablecoin freeze that caught $318,000, and the North Korea attribution question. decrypt

Magic Eden legacy approvals exposed $5.7 million in NFTs before a whitehat rescue. A flaw in Limit Break’s Payment Processor V2 contract left old Magic Eden Ethereum listings vulnerable, putting roughly $5.7 million in NFTs at risk. Whitehats intervened and rescued 23,155 tokens before any malicious actor could act. Users with old approvals should revoke them. theblock decrypt

US soldier sentenced to 70 months for the 2024 AT&T metadata theft. An Army soldier who pleaded guilty to hacking AT&T and Verizon and stealing call and text metadata belonging to over 100 million customers was sentenced to just under six years and ordered to pay $300,000 in restitution. The case is a rare criminal conviction tied to the 2024 US telecoms breach wave. krebsonsecurity

On the Hill

Hester Peirce leaves the SEC next week. The commission’s most consistent advocate for clear crypto rules is departing, removing a reliable internal voice that pushed back on enforcement-first approaches across multiple administrations. Her exit follows the collapse of the CLARITY Act and arrives as the SEC publishes a new crypto FAQ touching on token buybacks, network upgrades, and profit expectations. The FAQ signal is incremental; the loss of Peirce is structural. coindesk theblock

Blockchain Association CEO exits after CLARITY Act fails. Summer Mersinger, the former CFTC commissioner who took over the Blockchain Association in 2025, is stepping down after the CLARITY Act stalled in Congress. Founding CEO Kristin Smith returns as interim while the organisation searches for permanent leadership. The timing, immediately after the industry’s flagship legislative push collapsed, is not coincidental. coindesk theblock cointelegraph_regulation

Kalshi loses another appeals court ruling on sports event contracts. A second appeals court has found that Kalshi’s sports-event prediction contracts fall under state gambling regulation rather than CFTC jurisdiction, complicating the firm’s federal-only regulatory strategy. The ruling lands as multiple firms including OG.com, Coinbase, and Kraken parent Payward are seeking CFTC approval for single-stock perpetual futures, an entirely separate but equally contested product category. coindesk cointelegraph_regulation

Tether’s EQIBank exposure confirmed as minimal after $89 million US asset seizure. US prosecutors moved to seize $84–89 million from accounts linked to EQIBank and a Montana payments firm alleged to have processed unlicensed transfers, with Tether and Bitfinex named as having held assets at the bank. Tether issued a statement describing its exposure as limited. The action is the most direct US government intervention touching Tether’s banking relationships in several years. coindesk cointelegraph_regulation decrypt

What else is grinding?

  • Researchers published a Zcash-style ‘Shielded Bitcoin’ spec that hides senders, receivers, and amounts without requiring a protocol change, though how BTC enters and exits the shielded pool is deferred to a follow-up paper. coindesk decrypt
  • XRP Ledger’s Batch transaction upgrade slipped to 9 October after validator support unexpectedly reset, delaying a feature that allows multiple operations to be bundled atomically. coindesk
  • Ethereum full-node sync time dropped to under half a day following EIP-4444 history-expiry optimisations, a meaningful accessibility improvement for smaller operators. cryptobriefing
  • Defence Secretary Pete Hegseth’s annual financial disclosure shows a Bitcoin holding worth between $16,000 and $65,000 held in a Coinbase wallet. decrypt
  • A man was charged over his role in a $16 million pig-butchering crypto scam, one of the larger individual-victim cases to reach federal charges this cycle. theblock
  • Strive raised enough through its perpetual preferred stock offering to acquire roughly 1,400 BTC worth $117 million, adding to its Bitcoin treasury without taking on traditional debt. cryptobriefing

Last sip. LayerZero has not publicly responded to KelpDAO’s claim that it approved the single-verifier setup in writing, and the rsETH litigation timeline is still wide open.