Bitget has revised the scale of its security breach after initially reporting a smaller figure for the amount of crypto impacted. In an updated incident report, the exchange said roughly $388 million in assets were affected—higher than Thursday’s estimate of $352 million.

In a follow-up update on Friday, Bitget also confirmed it would continue pausing withdrawals while it investigates, and it introduced a bounty program designed to encourage the freezing or recovery of stolen funds. The exchange attributed the upward revision to a more complete accounting of transfers during the incident, including assets on networks not captured in the first report.

Key takeaways

• Bitget revised the breach impact to about $388 million, up from the previously reported $352 million.
• About $387.5 million was traced to attacker-controlled addresses, based on onchain monitoring—around $35 million more than previously disclosed.
• Withdrawals remain paused, while the exchange says the incident is contained and no further unauthorized transfers are possible.
• Bitget says the change reflects fuller accounting, including additional affected assets on Zcash and TRON that were missing from the initial estimate.
• The breach involved multiple networks, including EVM chains, the XRP Ledger, Zcash, and TRON, with multiple asset types listed.

Recalculated losses: what changed in Bitget’s numbers

Bitget’s revised incident report clarifies that the affected amount was understated in the first estimate. According to the exchange, its revised figures reflect a more complete accounting of transfers that occurred during the breach—specifically by adding affected assets on Zcash and TRON that were not included in the initial calculation.

Bitget emphasized that the update does not indicate additional theft beyond what was already captured during the incident window. The company stated that the incident remains contained and that no further unauthorized transfers are possible.

In practical terms for users and market participants, the revision matters because it changes how investors assess the severity of the event and the scope of remediation Bitget must carry out—particularly for assets moved to addresses controlled by the attackers.

Where the funds went: tracing to attacker-controlled addresses

Alongside the updated total, Bitget reported that $387.5 million were transferred to attacker-controlled addresses according to onchain tracing. That figure is about $35 million higher than what was reported on Thursday.

The exchange framed the difference as an accounting refinement rather than an expansion of the breach’s duration or a new wave of withdrawals being stolen. Bitget said the updated estimate includes additional transfers involving assets on Zcash and TRON, helping align its reported figures with a more comprehensive view of movement across affected chains.

For traders and users, the most important operational takeaway is that Bitget’s control measures continue—withdrawals are still paused—while the company focuses on identifying and potentially freezing or recovering funds connected to the hack.

Networks and assets named in the incident update

Bitget said the incident involved addresses spanning multiple ecosystems, including Ethereum Virtual Machine (EVM) networks, the XRP Ledger, Zcash, and TRON. The exchange listed a range of assets that were stolen, including:

The follow-up report, however, did not directly address comments made by Bitget CEO Gracy Chen on Thursday. Earlier coverage from Cointelegraph noted her speculation that a North Korean hacking group may have been behind the attack, citing what she described as IP-related clues.

With the company now focusing on the revised scope of funds moved and its response plan, the attribution question remains separate from the immediate need to secure withdrawals and work through the largest cross-chain theft figure Bitget says it identified.

What the bounty program signals for recovery efforts

Bitget’s Friday update included a decision to keep withdrawals paused and to launch a bounty program. While the details of how participants can qualify are not included in the article text provided, the stated purpose is clear: to encourage freezing or recovery of stolen assets.

In previous breach cases across crypto exchanges and custodial services, incentives aimed at accelerating fund discovery and coordination have become a common response pattern—particularly when assets are already moved across multiple networks. By tying the recovery push to a bounty, Bitget appears to be attempting to widen the net beyond internal controls and forensic analysis.

At the same time, the exchange’s insistence that “no further unauthorized transfers are possible” suggests it believes attackers’ ability to continue moving funds has been interrupted—though users will ultimately want confirmation as withdrawals resume and balances are reconciled.

A major industry incident, compared with other recent hacks

Even with the updated accounting, Bitget’s breach remains among the largest security incidents to hit the crypto industry. The incident is now described as causing about $388 million in affected assets, placing it in the same category of major exchange events that have shaken user confidence and forced rapid operational changes.

The article also notes a recent benchmark from earlier in the industry cycle: hackers stole about $1.5 billion worth of Ether from Bybit in February 2025. That comparison underscores how, despite improvements in security practices over time, large-scale thefts can still occur—and that recovery efforts often extend beyond the initial incident window.

For Bitget customers, the next phase will likely center on how quickly the platform can finalize asset reconciliation, whether withdrawal pauses can be lifted in stages, and how the bounty program contributes to recovering—or at least mitigating—the portion of funds that ended up in attacker-controlled addresses.

As Bitget continues its review, investors and users should watch for updates on withdrawal timelines and any additional operational details around the bounty program’s implementation, alongside evidence that the exchange’s claims of containment hold up as funds are fully traced and accounted for.

Alpenglow changes how validators, the computers that check transactions, agree on the network’s records. They will exchange votes directly instead of recording those votes as transactions inside blocks, the batches of transactions added to the blockchain. Agreement can then take one or two voting rounds.

Removing those votes will also make some Solana activity charts fall. Transaction totals that include validator votes will shrink even if users make just as many payments and trades. The Foundation has told data providers to adjust their comparisons.

Services that build transaction histories also need to keep competing candidate blocks separate until the network selects one. Mixing their contents could produce an incorrect record.

Applications that simply send transactions and read account balances require no migration, according to the Foundation’s guide.

The speed figure remains a target derived from simulations, rather than a demonstrated result under live-market conditions. Wallet processing and exchanges’ own deposit checks can add further waiting time.

No firm launch date has been announced for the live network. Anza’s software schedule tentatively allows feature activations to resume Sept. 28, but does not identify that date as Alpenglow’s launch.

A new bottom line?

Summer Mersinger, a former U.S. Commodity Futures Trading Commission (CFTC) commissioner, is stepping down as CEO of the Blockchain Association and will leave the advocacy group at the end of the year. The change comes after one of the organization’s top legislative priorities stalled in Congress, underscoring how quickly momentum in Washington can shift for crypto policy groups.

On Friday, the Blockchain Association said Mersinger will step down on Oct. 16, when Kristin Smith—who previously led the organization—returns as interim CEO. Mersinger joined the Blockchain Association in June 2025 after departing the CFTC three years ahead of the scheduled end of her second term as a commissioner.

Key takeaways

• The Blockchain Association announced a leadership transition: Summer Mersinger will exit as CEO on Oct. 16, with Kristin Smith returning as interim CEO.
• Mersinger’s tenure emphasized stablecoin-focused policy efforts, including the GENIUS Act, and efforts to improve regulatory clarity across the SEC and CFTC.
• One major legislative priority—tied to a Senate “clarity” effort for digital assets—failed to advance on a cloture motion, raising the likelihood of delay into later Congresses.
• The association did not publicly address what the leadership change could mean for its remaining 2027 policy strategy.

Leadership transition at the Blockchain Association

The Blockchain Association’s announcement sets a clear timeline for the organization’s top leadership. Mersinger will step down as CEO on Oct. 16, aligning with Kristin Smith’s return as interim CEO. The group also indicated that Mersinger will leave the organization by year’s end.

According to Mersinger, her move to the association was driven by a desire for clearer regulatory “rules of the road” and a unified policy voice in Washington. She joined the advocacy group after leaving the CFTC earlier than the completion of her second term, which many observers interpreted as a shift from regulator to policy advocate.

Stablecoins and regulatory clarity remain the headline of her tenure

In explaining Mersinger’s impact, the Blockchain Association pointed to her work advancing the “Guiding and Establishing National Innovation for US Stablecoins” framework—commonly referred to as the GENIUS Act. The organization also credited her with efforts aimed at improving regulatory clarity with both the Securities and Exchange Commission (SEC) and the CFTC.

The emphasis on stablecoin legislation is notable because stablecoin policy has been a recurring flashpoint for U.S. crypto regulation. For advocacy groups, stablecoins are often treated as a practical focal point: they are already widely used for payments, trading, and settlement, while lawmakers continue to debate how existing securities and commodities regimes should apply.

Importantly, the association’s statement did not limit itself to stablecoins alone; it suggested a broader goal of clarifying enforcement and compliance expectations across agencies. That matters to market participants because regulatory uncertainty can translate into higher compliance costs, delayed product launches, and shifting legal risk assessments—especially for firms operating at the boundary between securities-like activity and commodities-like activity.

The setback in Congress changes the political clock

While the Blockchain Association highlighted GENIUS Act progress, it did not mention another Senate effort that had been repeatedly urged by the organization: the Digital Asset Market Clarity Act, which had been under consideration in the Senate.

Previously, the Blockchain Association pushed lawmakers to support the measure, sharing calls for action through its social media channels. However, coverage noted that the bill failed to gain enough votes during a cloture motion earlier this month, according to the original reporting cited by Cointelegraph.

Experts expect that outcome to leave the legislation in limbo until 2027—an extended delay that can be consequential for an advocacy group’s strategy. Legislative priorities that do not clear procedural hurdles often lose momentum as attention moves to other issues or as new political dynamics take over. For stakeholders watching U.S. crypto regulation, it also suggests that near-term certainty may remain difficult to achieve even when industry support for a framework is visible.

The timing is especially relevant for leadership decisions. The association’s communications did not explicitly tie Mersinger’s departure to any single vote outcome, but the context is difficult to ignore: a major policy push appears to have stalled right as she is exiting.

What comes next for the group—and what to watch

The Blockchain Association did not immediately respond to questions about what Mersinger’s plans are beyond her departure, including any strategy for 2027. That leaves open a key question for members and observers: whether the organization will adjust its legislative priorities or shift its messaging focus as the political calendar extends.

With Kristin Smith stepping in as interim CEO, attention will likely turn to how the group reallocates its efforts—particularly whether it keeps pursuing the Senate clarity push or doubles down on alternative paths, such as agency-level rulemaking or narrower frameworks like stablecoins. For crypto industry participants, the leadership handoff may signal continuity in advocacy priorities, but the legislative calendar suggests that tangible progress may still depend on votes and procedural outcomes that can take months to overcome.

Readers should watch for any new statements from the association on its legislative roadmap after the cloture failure, along with signals from congressional leadership on whether any crypto-related bills can move without being trapped in extended procedural delays.

An XRP Ledger upgrade expected to activate Sept. 29 has been pushed back by at least 10 days after validator support briefly fell below the level required to turn it on.

The feature, called Batch, would let users submit up to eight transactions together. Its all-or-nothing option could let a buyer pay for a tokenized asset and receive it in one operation, preventing either side of the trade from completing alone.

RippleX’s head of engineering, Ayo Akinyele, previously told CoinDesk that projects were being built around Batch and that Ripple would share more about work with asset managers once the feature went live.

“Some projects are already being built with Batch in mind, so activation would allow that work to move closer to production,” he said. He did not name the partners or give launch dates.

The corrected upgrade, formally named BatchV1_1, regained support from 30 of 35 trusted validators on Sept. 25, according to the XRPL amendment dashboard. That started a fresh two-week countdown, putting its earliest activation at Oct. 9 around 14:46 UTC if support holds.

Privacy has become a practical concern in recent months as developers try to make cryptocurrencies useful for payroll, business payments and everyday spending. Ordinary bitcoin transactions permanently expose amounts and addresses, but once an address is linked to a company or person, other payments associated with it become easier to follow.

Ethereum is also reviewing a proposal for a shared private pool that would let people transfer ether and other tokens without publicly revealing payment details. Its authors cite payroll, treasury management and donations among the uses poorly served by fully public transactions.

How Zcash works

Zcash lets users choose between transparent payments, whose addresses and amounts are public, and shielded payments that encrypt those details. Its shielded pools held about 4.9 million ZEC on Friday, up 14% from July 30, according to CoinDesk calculations using ZecStats data. That represents roughly 29% of issued coins, worth about $7.8 billion following the rally.

Zcash recorded roughly 63,000 shielded transactions last week, its busiest week for private transfers since 2022 and fourth-highest on record. Across the network, reported transfer volume exceeded $23 billion, the largest weekly total since 2021 and second-highest in its history.

Zcash has attracted both investor money and attention amid those metrics. By early September, ZEC had gained more than 2,300% over the preceding year and crossed $1,000. It extended the rally above $1,600 on Wednesday.

New warnings circulating among iPhone users link a malicious Safari-based attack to a potential exposure of cryptocurrency wallet secrets, including private keys and seed phrases. However, the threat intelligence firm that analyzed the specific Safari sample says it has not been able to independently confirm an actual theft from a compromised victim tied to that exact code.

In a statement provided to Cointelegraph, SlowMist said the campaign it investigated appears to reuse techniques from an earlier iOS exploit chain known as DarkSword. While multiple reports urged users to update immediately and cited an especially broad iOS window—“iOS 13 through iOS 26.5” in some coverage—SlowMist cautioned that this range should be treated as preliminary until the company can demonstrate reproducible technical evidence for the latest versions.

Key takeaways

• SlowMist has not independently confirmed a real victim compromise or confirmed crypto theft tied to the exact Safari sample it analyzed.
• The strongest technical evidence from SlowMist focuses on iOS 18.4 through 18.6.2.
• SlowMist says the suspected Safari exploit chain reuses techniques from Google-disclosed DarkSword, rather than being the same as the separate FomoPeek incident.
• The analyzed malware includes functionality aimed at reading and decrypting data from Apple Keychain, which can contain sensitive wallet-related information.
• Even without proof of a successful extraction on every targeted device, SlowMist still recommends updating iOS and avoiding suspicious links.

Why the iPhone warnings remain uncertain

Multiple reports this week prompted immediate iOS updates, warning that malicious Safari pages could potentially expose crypto private keys and seed phrases. Some of those reports referenced a wide range of iOS versions, extending from iOS 13 to iOS 26.5.

SlowMist’s assessment is more restrained. The company told Cointelegraph that it has not independently verified a victim device compromised by the particular Safari attack sample it reviewed. It also indicated that the iOS range appearing in public warnings may be broader than what it can technically support right now.

In particular, SlowMist said it “prefer[s] to avoid stating that iOS 26.5 is affected until there is reproducible technical evidence,” and noted its strongest evidence spans iOS 18.4 through 18.6.2. That distinction matters for users and organizations because overbroad impact claims can either create unnecessary fear on unexposed versions or, conversely, obscure where defenses should be prioritized first.

What SlowMist says was reused from DarkSword

The Safari campaign is not being treated by SlowMist as an entirely new exploitation method. According to SlowMist, the attack reuses techniques from DarkSword, an iOS exploit chain disclosed by Google’s Threat Intelligence Group (GTIG) in March. Google described DarkSword as having been used by multiple threat actors since at least November 2025, and documented the exploit chain publicly in a dedicated threat intelligence post.

SlowMist said its own MistEye threat intelligence team—led by chief information security officer 23pds—first identified relevant activity in early May. Later, SlowMist published its analysis of the “WYINCC” Safari campaign on Sept. 4, describing how the malicious page presented a lure related to a free virtual private server service.

SlowMist reported that when the page was opened in Safari on an iPhone, the exploit code could load without necessarily requiring an additional user click. Apple later patched the vulnerabilities used in the chain, and SlowMist stated that those underlying weaknesses had already been disclosed and fixed.

Importantly, SlowMist also separated this issue from a different investigation it previously ran regarding FomoPeek—an iOS App Store-related incident described in earlier Cointelegraph coverage. SlowMist characterized the Safari attack as distinct from that separate App Store compromise vector.

Targets inside the device: Apple Keychain and wallet exposure

Beyond the exploit mechanism, SlowMist highlighted what the malicious sample was trying to access. In its analysis of the sample, the firm said the code included capabilities to interact with Apple’s Keychain—retrieving and decrypting information stored there. SlowMist added that the code could also access app files and shared app data, which could potentially include sensitive data handled by crypto wallet applications.

At the same time, SlowMist emphasized limits in what can be proven from static or controlled analysis. The company said the sample “demonstrates the collection capability and the intended targets,” but does not automatically prove successful extraction from every wallet or every targeted device.

Critically, SlowMist said it did not execute the full chain on a real victim device, which is why it cannot identify a specific victim whose device it independently confirmed was successfully compromised by that exact sample.

Recommendations: update, avoid links, and move funds if exposed

Even with those uncertainties, SlowMist urged iPhone users to take practical defensive steps. The firm advised updating to the latest iOS security updates available for affected devices and avoiding suspicious links—especially those delivered via unsolicited messages or pages that promise free services.

For users who cannot update immediately or who face elevated risk, SlowMist pointed to Apple’s Lockdown Mode as an additional layer of defense. However, the company cautioned that it has not confirmed Lockdown Mode fully blocks this specific Safari attack.

SlowMist also offered guidance for wallet users who believe their credentials may have been compromised. Its recommendation was to move assets to a newly generated wallet created on a clean device rather than continuing to use potentially exposed private keys or seed phrases.

As more technical details become available, the key question for investors, traders, and wallet users is whether reproducible evidence will narrow the affected iOS versions further—and whether researchers can confirm how often, and under what conditions, the Keychain access successfully results in usable wallet secret extraction on real devices. For now, the safest approach remains the straightforward one highlighted by SlowMist: update promptly, be cautious with Safari links, and treat any suspected seed or key exposure as a reason to rotate credentials immediately.

Summer Mersinger, the former US Commodity Futures Trading Commission (CFTC) commissioner who led the Blockchain Association, will step down as chief executive as the advocacy group heads into its next chapter. The organization says Mersinger will leave the role on Oct. 16 and will depart the Blockchain Association at the end of the year.

In a move the group framed as a return to familiar leadership, Kristin Smith—Blockchain Association’s former CEO—will take over as interim CEO on Oct. 16 while continuing her existing position as president of the Solana Policy Institute.

Key takeaways

• Summer Mersinger will step down as CEO of the Blockchain Association on Oct. 16.
• Kristin Smith is set to return as interim CEO while remaining president of the Solana Policy Institute.
• The Blockchain Association cited progress on stablecoin policy, including work connected to the GENIUS Act.
• The group’s update did not mention a separate stablecoin/regulatory push in the Senate that failed to advance earlier this month.

Why the CEO transition is happening

The Blockchain Association said Mersinger’s departure follows a setback for one of the organization’s key legislative priorities in Congress. The group’s announcement indicates it sees the leadership change as timed with a period of renewed advocacy, starting with Smith’s interim return.

Mersinger joined the Blockchain Association in June 2025 after leaving the CFTC years earlier than the planned end of her second commissioner term. Her background at the regulator is a core part of the story: the association emphasized that she joined the industry effort to build a unified policy message in Washington.

“I came here from the CFTC because I believed this industry deserved clear rules of the road and a credible, unified voice making the case for them in Washington,” Mersinger said in remarks tied to her departure, according to the Blockchain Association’s announcement.

Legislative focus: GENIUS Act and broader “clarity” goals

In explaining her tenure, the Blockchain Association pointed to Mersinger’s efforts related to the Guiding and Establishing National Innovation for US Stablecoins (GENIUS Act). The organization also credited her work with achieving more regulatory clarity across both the Securities and Exchange Commission (SEC) and the CFTC.

That emphasis matters because US crypto policy remains fragmented between agencies and often depends on how lawmakers define stablecoins and other digital assets. For advocacy groups, demonstrating progress toward a workable regulatory framework—rather than only case-by-case enforcement—can shape how seriously Congress treats proposed bills and how businesses plan compliance strategies.

A Senate setback the association didn’t highlight

While the Blockchain Association highlighted stablecoin-related work around GENIUS, it did not reference a separate Senate measure it had previously urged lawmakers to support. In earlier outreach, the association pushed for the Digital Asset Market Clarity Act—a bill described in coverage as being under consideration in the Senate.

According to reporting linked in the original announcement’s context, the Senate failed to move the legislation forward. The measure was not able to secure enough votes in a cloture motion earlier this month, with expectations that it could remain stalled until later in the decade—potentially stretching into 2027.

The Blockchain Association did not provide immediate details on what the leadership change means for its plans for 2027, nor did it outline a replacement strategy for the stalled legislation in the information provided with this CEO update.

Leadership change and what to watch next

With Mersinger stepping down on Oct. 16 and Kristin Smith taking over as interim CEO, the next phase of the Blockchain Association’s legislative campaign may hinge on how it reframes its priorities after the Senate cloture result. Investors and builders watching US crypto regulation will want to pay close attention to whether the organization pivots to alternative bills, refines its approach to stablecoin definitions, or focuses more on agency-level guidance given the SEC/CFTC dynamics mentioned by the association.

For now, the key uncertainty is timeline: the stalled Senate effort suggests near-term momentum may be limited, even as internal leadership transitions prepare the advocacy group for the legislative calendar ahead. Readers should watch for updates on the association’s next set of targets in Congress and whether the “clarity” push remains centered on stablecoins—or broadens to other parts of the digital asset market.