Cryptoccino — Tuesday 29 September 2026
☕ 7 min read
Today's Roast
Decaf morning · top move 1.6% (DOGE)
The Pour. Greed still reads 73 on the dial, but the market spent Monday quietly unwinding its own confidence.
Today. Bitget’s $388M exploit: what the attacker did before the drain Security Desk · Bitcoin stalls at $83K as Iran tensions push oil past $100 Markets · Coinbase clears its full derivatives stack after CFTC DCO approval Projects & Money.
Prices
- BTC$83,460−1.1%
- ETH$2,658−1.4%
- BNB$772+0.1%
- SOL$120−0.3%
- XRP$1.50−0.9%
- DOGE$0.0943−1.6%
SECURITY DESK
Bitget Attacker Ran Test Transfers Before $388 Million Drain, THORChain Refuses to Help.
What happened. Bitget CEO Gracy Chen confirmed the attacker probed the exchange’s risk controls with two small test transfers roughly 30 minutes before executing the full $388 million theft. The exchange has since patched the vulnerability and begun a phased resumption of withdrawals, pledging to cover all losses from its user protection fund.
Why it matters. The reconnaissance pattern is textbook: small-value transfers to confirm controls are blind before the real drain. That it worked at an exchange of Bitget’s scale points to gaps in real-time anomaly detection that any exchange security team should be pressure-testing today. The Fear & Greed Index still sits at 73, meaning retail is not yet pricing in contagion risk from a nine-figure exchange breach.
The catch. Bitget asked THORChain to block the hacker’s address after roughly $6 million had already bridged to Bitcoin, and THORChain’s governance declined, citing its censorship-resistance principles. That refusal effectively confirms that once funds reach a permissionless cross-chain router, exchange-level recovery efforts are over. It is a live demonstration of why pre-bridge controls are the only controls that matter.

Bitcoin holds $83K as macro headwinds reassert themselves. Trump’s rejection of Iran’s ceasefire proposal pushed oil above $100 and sent yields higher, dragging Bitcoin off last week’s highs and triggering $531 million in cross-market crypto liquidations over 24 hours. Altcoins that rallied on Friday gave back most of those gains by Monday, with ZEC down 12% on the session. Wednesday’s PCE print is the next hard catalyst.
coindeskdecryptbloomberg_cryptocryptobriefing
Solana ETFs post a record $188 million weekly inflow. Bitwise captured roughly two-thirds of last week’s SOL ETF flows, cementing its early lead in the product category. The record week lands even as broader sentiment softens, suggesting institutional allocators are making programmatic entries rather than momentum-chasing.
coindesk
Goldman Sachs connects its $100 billion Treasury fund to crypto settlement rails. Goldman’s move brings a flagship money-market-adjacent vehicle into crypto’s institutional plumbing, effectively letting counterparties use the fund as collateral within digital-asset workflows. The integration is structural rather than speculative, pointing to back-office adoption accelerating well ahead of any retail narrative.
coindesk
Stablecoin card spending hit a weekly record of $189 million. The week of 14 September saw stablecoin-funded card transactions reach an all-time high, according to on-chain data. The figure tracks alongside the Citi-Coinbase tie-up announced this week, suggesting the payment-rail buildout is already generating measurable consumer volume.
cryptobriefing

Coinbase completes its full derivatives stack with CFTC DCO approval. The Designated Clearing Organisation licence means Coinbase can now list, broker, and clear fully collateralised derivatives products entirely in-house, removing dependence on third-party clearing infrastructure. It is also paired with the Citi partnership that lets Citi’s institutional clients accept stablecoin payments over Coinbase rails, a significant expansion of Coinbase’s B2B footprint.
theblockcoindeskbloomberg_cryptodecrypttheblock
Strategy and Strive both added to their BTC treasuries last week. Strategy bought 1,665 BTC for $143 million, lifting total holdings to 847,666 BTC, roughly 4% of the hard-capped supply. Strive added 1,107 BTC for $94.5 million, funded 85% through its SATA preferred stock, taking its stack past 27,400 BTC.
theblockdecrypttheblockdecrypt
Bitmine now controls 4.9% of Ethereum’s circulating supply. Tom Lee’s firm bought a further $47 million of ETH, bringing its total to over 6 million tokens, of which 84% are actively staked. Bitmine projects roughly $358 million annually in staking yield from that position, though that figure is sensitive to ETH price and validator queue dynamics.
theblockdecrypt
Vitalik sets Hegota as Ethereum’s last conventional hard fork. Buterin’s latest technical post argues that after Hegota, Ethereum’s upgrade path should run entirely through recursive STARKs and formal verification rather than traditional forks. The framing repositions Ethereum’s long-term roadmap as a gradual shift toward a cryptographically provable execution environment, with significant implications for client teams and tooling.
decrypt

Bitget exploit detail and THORChain refusal. Full coverage in today’s lead. Short version: $388 million drained after two reconnaissance transfers, $6 million already in Bitcoin after THORChain declined to intervene.
theblock
UC San Diego team fakes a hardware security module without touching its key. Researchers demonstrated an RSA attack that allows an adversary to impersonate an HSM by exploiting the verification logic rather than extracting the private key itself. For crypto custody operators relying on HSM-backed signing, the attack surface is the attestation layer, not the key store.
decrypt
Dutch police arrest a ShinyHunters-linked suspect, triggering escalation. A 23-year-old previously convicted hacker was detained in the Netherlands on suspicion of supporting ShinyHunters’ data theft and extortion operations. Remaining group members responded by breaching FBI systems and extorting the Cl0p ransomware gang within days of the arrest.
krebsonsecurity
Chainlink ships CCIP 2.0 with institution-configurable bridge security. Five months after a rival bridge lost $292 million, Chainlink’s updated cross-chain protocol lets institutions layer their own security checks on top of the base CCIP validation. The move is partly a positioning play against the perception that bridge security is a black box.
coindeskdecrypt

CLARITY Act fails cloture, both SEC and CFTC respond with staff guidance. The Senate vote to advance the digital-asset market structure bill fell short, with the White House attributing the failure to Democratic opposition. Both the SEC and CFTC moved the same week to issue staff-level guidance on token treatment, suggesting regulators are filling the legislative vacuum administratively rather than waiting for Congress.
cointelegraph_regulationcryptobriefingdecrypt
Senate Democrats publish report calling Tether a lifeline for Iran’s shadow banking network. The investigation concludes USDT has become central infrastructure for Iranian entities circumventing sanctions, a framing Tether is likely to contest. The report’s timing, alongside the CLARITY Act failure, gives Democratic members a concrete enforcement narrative as market-structure talks stall.
coindesktheblock
California bans public officials from issuing or promoting memecoins. Governor Newsom signed the legislation and explicitly framed it as a rebuke of Trump’s personal token activity, while a companion bill sets clearer restitution rules for crypto fraud victims. Exchanges operating in California face new listing restrictions on politician-linked tokens.
coindesktheblockdecrypt
Crypto PAC Fairshake commits $11 million against Ohio Senator Sherrod Brown. The spend targets Brown’s re-election campaign in a repeat of the industry’s 2024 electoral strategy against crypto-sceptic incumbents. Fairshake has pledged $30 million in total media against Brown, making Ohio a key test of whether crypto political spending translates to Senate seats in a non-presidential cycle.
cointelegraph_regulation
What else is grinding?
- Franklin Templeton’s tokenised collateral service is now live on Bybit, letting traders use fund shares as margin without liquidating positions.
coindesk - Hester Peirce wrapped up her final week at the SEC, departing with several crypto-friendly rule changes still unfinished after nearly a decade at the agency.
theblock - Hong Kong’s SFC and AFRC signed a memorandum of understanding extending financial reporting and audit oversight to licensed virtual asset service providers.
cointelegraph_regulation - Uniswap holds $82 million in tokenised equity deposits, the largest single-protocol position as DeFi’s real-world asset push extends into traditional equities.
cryptobriefing - South Korea is revisiting its effective ban on crypto market-making after a JPYC token briefly traded at four times its peg on Upbit, exposing thin-liquidity risks under the current rules.
cointelegraph_regulation - RedotPay completed an external financial audit and confirmed it is pressing ahead with a US IPO, with the audit serving as a prerequisite for the listing process.
coindesk
Last sip. The Bitget funds are in Bitcoin now, and THORChain has made clear it will not be the last stop the attacker uses.