Blockchain & Digital Assets — September 28, 2026
A new Bitget incident disclosure puts third-party credential controls in focus; California enacted a public-official memecoin ban, while Chainlink changed bridge verification. Tokenized collateral expands at Bybit as Bitcoin retreats amid broader macro pressure.
Written by NPDev Labs with AI assistance and reviewed before publication. How we work.
Bitget attributes $388 million exploit to third-party security flaw
SECURITY · REPORTED. Bitget CEO Gracy Chen told Cointelegraph that attackers obtained high-level internal credentials through a third-party security product and issued fraudulent withdrawals; she said private keys and cold wallets were unaffected. The September 24 breach remains under investigation, with recovery totals and any North Korea link unconfirmed. Why it matters: Credential and vendor controls can be as consequential as private-key custody; treat the loss figure and attribution as company-reported pending independent findings. Source:
California signs prohibition on public officials issuing memecoins
U.S. POLICY · ENACTED. Governor Gavin Newsom signed AB 2409 on September 27 as part of an anti-corruption package barring California public officials from issuing memecoins; the measure was announced alongside other crypto-crime and consumer-protection bills. Why it matters: The state is directly targeting conflicts of interest in official-backed tokens, separate from federal digital-asset market-structure debates. Source:
Chainlink releases CCIP 2.0 with optional custom verifiers
INTEROPERABILITY · RELEASED. Chainlink released an upgrade letting applications add their own verifiers atop its default 16-operator network; CoinDesk reports that its former separate Risk Management Network is no longer an independent safeguard in this design. Named adopters of the new custom verifiers have not yet been disclosed. Why it matters: Bridge users should assess the actual verifier configuration rather than assuming an optional security layer is deployed. Source:
Franklin Templeton extends tokenized fund collateral program to Bybit
TOKENIZATION · ANNOUNCED. Franklin Templeton is expanding its off-exchange collateral program to Bybit: eligible users can pledge tokenized money-market fund shares held through ByCustody for USDT or USDC trading credit lines, according to its announcement reported by CoinDesk. Why it matters: Off-exchange custody and collateral mirroring could reduce exchange exposure while linking traditional fund shares to crypto-market liquidity; eligibility and counterparty risks still matter. Source:
Bitcoin retreats toward $83,000 as oil and bond worries weigh on risk assets
MARKETS · REPORTED. CoinDesk reported Bitcoin near $83,000 and down roughly 1.7% since midnight UTC on Monday, with its broader crypto index down 2.6%; Brent rose above $100 amid Iran-related tensions. The macro catalyst is an interpretation, not a proven single cause of the move. Why it matters: The cross-asset selloff is more informative than isolated token price action; avoid assigning a precise cause to short-term crypto moves. Source:
Vitalik Buterin sketches a proof-centric Ethereum for 2030
ETHEREUM · VISION. In a September 27 essay, Buterin described a possible future Ethereum with SNARK-based verification, parallelized computation and stronger transaction and wallet privacy. These are roadmap aspirations, not deployed network changes. Why it matters: Developers should track verification costs, data availability and privacy tooling without confusing a long-range architecture with an upgrade already live. Source:
SEC staff addresses token buybacks in crypto-asset FAQs
U.S. POLICY · STAFF VIEW. The SEC Division of Corporation Finance published FAQs on September 25; as reported by Decrypt on September 27, staff distinguish buyback announcements for functional networks from profit-linked promises made before a network is functional. The FAQs are staff guidance, not binding law or a blanket exemption. Why it matters: Issuer communications and network maturity may materially affect legal analysis; the agency staff view does not eliminate private-litigation or future-policy risk. Source:
Hong Kong regulators extend audit cooperation to licensed virtual-asset firms
HONG KONG · OFFICIAL AGREEMENT. Hong Kong’s SFC and AFRC announced a new memorandum of understanding covering financial and compliance reporting, audit work, information sharing and coordinated oversight for SFC-licensed virtual-asset service providers and other regulated entities. Why it matters: Licensed exchanges face more coordinated scrutiny of financial reporting and assurance, beyond licensing alone. Source:
Bottom line
Security and operational controls, rather than token price momentum, lead today’s agenda. The regulatory items are distinct in legal force: California enacted a law, Hong Kong regulators signed an oversight agreement, and the U.S. SEC item is nonbinding staff guidance.
As of
September 28, 2026, 15:00 UTC