Security tests exchanges as institutions deepen onchain exposure
A $351.6 million Bitget breach and two smaller infrastructure incidents put custody and bridge controls back under scrutiny. At the same time, U.S. crypto ETFs drew more than $3 billion this week, Ondo launched BlackRock-designed tokenized portfolio strategies, and the CFTC clarified how registered firms may use tokenized investments and blockchain records.
Written by NPDev Labs with AI assistance and reviewed before publication. How we work.
Bitget says a $351.6 million breach bears signs of North Korean tradecraft
Section: Top stories. Status: SECURITY · REPORTED. Bitget said the September 24 attack affected assets across Ethereum, XRP Ledger, BNB Chain, Avalanche, Arbitrum, Optimism and Base; withdrawals remain suspended while the exchange and outside investigators trace and freeze funds. The North Korea attribution is still under investigation, and the final loss could fall if assets are recovered. Why it matters: A loss at the current estimate would equal roughly 76% of Bitget’s $464 million protection fund, making this a major test of exchange backstops, proof-of-reserves snapshots and the speed of cross-chain incident response.
CFTC updates crypto FAQs for tokenized investments and blockchain recordkeeping
Section: Top stories. Status: REGULATION · CONFIRMED. CFTC staff updated its guidance on September 24 to address customer funds invested in tokenized forms of otherwise permitted investments and the use of blockchain technology to satisfy registrants’ recordkeeping duties. The update builds on the agency’s March FAQs and prior guidance on tokenized collateral and digital assets used as margin. Why it matters: The guidance narrows a practical compliance gap for futures firms that want to use onchain instruments or records without treating the technology itself as disqualifying, though it is staff guidance rather than a new statute.
SEC Commissioner Peirce urges privacy-preserving alternatives to repeated KYC collection
Section: Top stories. Status: POLICY · COMMISSIONER REMARKS. In September 23 remarks, Hester Peirce argued that reusable, attribute-based digital credentials could prove facts such as age, citizenship or sanctions status without every financial institution retaining the same underlying identity records. She framed the idea as a way to improve financial-crime controls while reducing surveillance and breach exposure; the remarks are her own views, not an SEC rule. Why it matters: Stablecoin issuers and exchanges face expanding identification and record-retention duties, so regulator support for selective-disclosure credentials could shape how compliance systems balance auditability with data minimization.
U.S. crypto ETFs take in more than $3 billion through Thursday
Section: Markets & institutional adoption. Status: MARKETS · REPORTED DATA. CryptoSlate, citing SoSoValue, reported about $3.04 billion of net inflows from Monday through Thursday: $2.25 billion into spot Bitcoin ETFs, $602.94 million into Ether products and about $189.7 million across Solana, XRP and Zcash funds. Bitcoin nonetheless struggled to hold above $85,000, so the flows have not translated into a clean price breakout. Why it matters: The week’s figures suggest institutional demand is broadening beyond Bitcoin, but the price response also shows that ETF buying can be offset by existing supply and macro positioning. The flow totals are third-party market data, not issuer filings.
Ondo launches tokenized portfolios based on BlackRock-designed strategies
Section: Markets & institutional adoption. Status: TOKENIZATION · CONFIRMED LAUNCH. Ondo launched three single-token portfolios on September 24 using model strategies BlackRock developed for Ondo. Ondo implements and rebalances the models with tokenized equities and ETFs; the tokens are Ondo-issued securities, not interests in BlackRock funds, and direct minting and redemption are limited to eligible non-U.S. investors. Why it matters: This moves tokenization from one-security wrappers toward managed basket exposure, but the legal and liquidity details matter: BlackRock is not the portfolio manager, U.S. access is excluded, and holders who cannot redeem directly may depend on secondary-market liquidity.
MultiversX resumes block production, while Kraken keeps EGLD functions restricted
Section: Protocols, products & regulation. Status: NETWORK RECOVERY · CONFIRMED. MultiversX said a recovery upgrade restored mainnet block production on September 24 after an attempted exploit of a virtual-machine atomicity issue halted the chain for about five days. Kraken’s latest incident notice still had EGLD pairs in cancel-only mode and deposits and withdrawals paused, with no reopening time posted. Why it matters: A chain restart does not automatically restore exchange access. The episode highlights the separate operational checkpoints users face across consensus recovery, exchange risk reviews and funding gateways.
Payy freezes transfers and card payments after an Ethereum bridge exploit
Section: Protocols, products & regulation. Status: BRIDGE INCIDENT · CONFIRMED DISCLOSURE. Payy said its Ethereum bridge was exploited on September 24 and paused deposits, withdrawals, transfers and card purchases while investigating. One onchain transaction moved about 1.83 million USDC from a Payy rollup contract, but Payy has not disclosed a total loss, customer impact, technical cause or restoration timetable. Why it matters: The incident shows how a bridge failure can propagate into an everyday payments product: even without a confirmed customer-loss figure, users lost the ability to move or spend balances through the service.
Researchers propose shielded Bitcoin transfers without a consensus change
Section: Protocols, products & regulation. Status: BITCOIN R&D · PROPOSAL. A September 24 paper from [[alloc] init] describes a metaprotocol that would publish encrypted notes, nullifiers and zero-knowledge proofs through Bitcoin while keeping privacy-state validation above the base consensus layer. The design is a research proposal, not a deployed feature, and its peg-in and peg-out construction remains unfinished. Why it matters: If the unresolved bridge and metadata problems can be solved, Bitcoin applications could gain stronger amount and counterparty privacy without a soft fork. For now, trustless entry and exit, light-client verification and leakage at the system edges remain open questions.
Bottom line
Security is today’s dominant operational signal: Bitget’s backstop faces its largest public test, while MultiversX and Payy show how recovery can leave users constrained even after the first technical response. The structural countertrend is institutional: ETF demand widened, tokenized portfolio products became more sophisticated, and U.S. derivatives guidance moved another step toward accommodating onchain infrastructure.
As of
September 25, 2026 at 15:04 UTC. Research emphasized developments published or materially updated within the prior 24–48 hours.