Bitcoin has held near $84,000 after twice failing to sustain moves above $87,000, while ETF inflows, whale accumulation and falling exchange balances continue beneath the price consolidation.

CoinGecko shows Bitcoin near $84,403 at the latest check, with a 24-hour range between $82,941 and $84,843. BTC has gained roughly 10.3% over seven days, keeping most of its rebound from last week’s low near $75,000.

The current pause follows a sharp reversal from September 16, when the Federal Reserve raised its target rate by 25 basis points to 3.75%–4.00%. One day earlier, Senate cloture on the CLARITY Act failed 49–50, short of the 60 votes needed to advance the bill.

BTC briefly traded close to $75,000 around those events before recovering above $80,000 and reaching $87,392 on September 21. The price has since retreated toward $84,000, leaving traders to assess whether demand behind the rebound remains strong enough for another attempt higher.

Why is Bitcoin price holding near $84K?

Bitcoin’s latest rejection came from the 86,000–87,000 zone, which has now stopped the price more than once. Crypto.news previously identified the $86,700 Bitcoin resistance and $82,000 support setup after the asset returned from its eight-month high.

Rekt Capital said BTC needs to stay above roughly $82,000, or successfully retest the level during another correction, to avoid falling back into its former 60,000–80,000 trading range. Bitfinex separately identified 85,000–86,500 as a dense buyer cost area after the latest rally.

The chart’s Bull Bear Power reading remains near +4,790. A positive BBP figure means bulls still exert more pressure than bears, though the latest histogram bars have fallen from their recent peak. Momentum therefore remains positive but weaker than during the surge through $82,000.

Chaikin Money Flow gives a less aggressive reading. CMF sits around 0.00 after recovering from negative territory, leaving buying and selling pressure close to balanced. A sustained move above zero would provide stronger volume-based evidence of accumulation, while another move below zero would show capital flow weakening as BTC tests support.

The combination leaves price momentum stronger than money flow. BBP continues to favor buyers, but CMF has not confirmed persistent buying pressure behind the move toward $87,000.

ETF inflows continue even as BTC consolidates

U.S. spot Bitcoin ETFs recorded another $191 million in net inflows on September 24, extending their positive streak to six trading sessions, according to SoSoValue data. BlackRock’s IBIT led the session with approximately $163 million, while Fidelity’s FBTC received $12.86 million.

The latest figure follows much larger subscriptions earlier in the week. Funds received approximately $999 million on September 21, $714.7 million on September 22 and $346.98 million on September 23. 

ETF flows had moved in the opposite direction around the Fed meeting. U.S. funds lost approximately $746.3 million across September 15 and 16 before demand returned, according to crypto.news’ analysis of who bought Bitcoin after the Fed rate hike.

The September 24 inflow brings the current streak to six sessions even though BTC has pulled back from $87,000. SoSoValue data reported through current coverage put cumulative U.S. spot Bitcoin ETF inflows near $57.41 billion, with net assets around $108.9 billion.

Are Bitcoin whales buying the pullback?

Large-holder activity has stayed active during the retreat. Crypto analyst Ali Martinez reported that large entities accumulated approximately 30,269 BTC during a 96-hour period, worth roughly $2.57 billion at the prices used in his calculation.

His estimate covers a period when Bitcoin fell around 5.24%, from approximately $87,400 to $82,800. The accumulation figure comes from on-chain wallet analysis and does not establish the identities of the entities buying the coins.

A separate Santiment dataset showed sustained accumulation before the latest correction. Wallets holding 100–1,000 BTC added 113,950 BTC between July 15 and September 23, increasing their combined holdings to roughly 5.24 million BTC. 

Wallet cohorts do not map directly to individual investors. One institution may control several addresses, while exchanges, custodians and funds can consolidate or separate holdings. The figures document changes in wallet balances without proving who ultimately owns each position.

Binance outflows add another signal below $87K

Exchange balances have moved in the same direction as large-wallet accumulation. CryptoQuant contributor Darkfost reported more than 13,800 BTC in net withdrawals from Binance during a single day, the exchange’s biggest daily net outflow since 2023.

Recent Binance netflows have averaged around negative 2,000 BTC per week, while the exchange’s Bitcoin holdings fell from approximately 705,000 BTC to 685,000 BTC within four days. Darkfost interpreted the withdrawals as accumulation because coins leaving an exchange may be moved into personal or institutional custody.

Exchange withdrawals do not prove that holders will keep their BTC or that prices must rise. Coins can leave an exchange for custody transfers, collateral use, over-the-counter transactions or other purposes. Darkfost’s interpretation remains an analyst assessment of the flow data.

CryptoQuant contributor Amr Taha reported a similar pattern across several venues from September 22 through September 24. His figures put combined negative netflows from Binance, Coinbase, Kraken and Bitfinex at roughly $2.52 billion over the three-day period.

The reported flows included approximately $1.57 billion in combined withdrawals on September 22, $438 million the following day and $511 million on September 24. The withdrawals continued while Bitcoin slipped from roughly $87,400 toward $84,000.

Is a Bitcoin breakout coming before October?

The first technical hurdle remains the same area that rejected BTC twice this week. A recovery through roughly $86,700 would return Bitcoin to the upper end of its recent range, while $87,392 remains the latest eight-month high. Crypto.news’ Bitcoin ETF and $86,000 breakout analysis previously identified returning fund demand and short covering as contributors to the rally.

October seasonality provides another data point, though historical returns cannot establish the next move. CoinGlass data tracks Bitcoin’s monthly performance, while historical records show October finished higher in 10 of the 13 years from 2013 through 2025.

Ali Martinez has cited the same 10-of-13 record while describing the approaching month as a possible “Uptober.” The pattern remains backward-looking: Bitcoin broke the streak in October 2025, when the asset finished the month around 3.9% lower.

Crypto exchange Bitget has confirmed that it detected unauthorized transfers tied to a security breach and has temporarily suspended withdrawals while it investigates. The exchange said the incident impacted assets totaling about $351.6 million, affecting a limited set of hot-wallet holdings.

Bitget reported that its systems identified the suspicious activity at 18:31 UTC on Thursday, triggering emergency response measures. In an effort to contain the damage, the company said the breach was limited to certain hot and warm wallet layers, while cold wallets remained secure.

Key takeaways

• Bitget says unauthorized transfers impacted approximately $351.6 million and were traced to a limited number of hot wallets.
• The exchange temporarily suspended withdrawals and is conducting a security review after detecting activity at 18:31 UTC.
• CEO Gracy Chen said affected funds were primarily concentrated on Ethereum, with other networks including XRP Ledger, Avalanche, BNB Smart Chain, and Arbitrum also involved.
• Bitget stated that user balances remain accurate and that deposits and trading continue normally.
• Chen said affected assets are more than covered by Bitget’s User Protection Fund, which the exchange says holds more than $464 million.

Unauthorized transfers detected in hot-wallet layers

In a statement posted on X, Bitget said its security monitoring systems detected unauthorized transfers originating from a small number of hot wallets. The firm linked the activity to emergency response procedures initiated immediately after the alert, with the incident date and time cited as 18:31 UTC on Thursday.

Speaking directly in a live Q&A, CEO Gracy Chen emphasized that the breach was contained to a portion of the exchange’s hot and warm wallet infrastructure. She also said Bitget’s cold wallets were not compromised.

According to Chen, the stolen or affected assets included Ether (ETH), XRP (XRP), USDt (USDT), USDC (USDC), Avalanche (AVAX), BNB (BNB), and USDT0 (USDT0) on Arbitrum. She attributed the largest concentration of observed stolen funds to Ethereum.

Multiple chains involved, with Ethereum the main concentration

Chen named several networks as affected, including Ethereum, the XRP Ledger, Avalanche, BNB Smart Chain, and Arbitrum. While Bitget highlighted Ethereum as the primary venue for the observed stolen funds, the exchange also reported activity across other ecosystems, suggesting the attacker or attackers operated across multiple wallet and chain configurations rather than a single isolated target.

Bitget’s communications also acknowledged how early onchain reporting differed from later disclosures. Chen said early onchain monitoring captured a smaller amount than what Bitget later reported because the incident extended beyond the Ethereum activity reflected in those initial traces. That distinction matters for traders and users because estimates of breach scope can change as investigators widen the analysis window and broaden the search beyond the first chain clusters detected.

Withdrawals paused; deposits and trading continue

Bitget said it has temporarily suspended withdrawals as part of its security review. Chen indicated that she expected withdrawals to resume within hours or days, framing the pause as a precaution while the exchange verifies controls and assesses the extent of the unauthorized movement.

At the same time, Bitget told users that account balances remain accurate. The exchange also said deposits and trading are operating normally, a key operational detail for customers who might otherwise anticipate a full platform halt during a security incident.

The exchange said it has flagged addresses associated with the transfers and has reached out to law enforcement as well as onchain security firms, aligning with the typical process exchanges follow in response to suspected theft—identify suspect sources, trace downstream movements, and coordinate takedown or mitigation efforts where possible.

User Protection Fund to cover affected assets

Beyond containment and monitoring, Bitget addressed customer risk directly by referencing its User Protection Fund. Chen said the affected funds are more than covered by the fund, which the exchange stated currently holds more than $464 million.

Bitget also said it would provide hourly updates to reflect its ongoing investigation. In addition, the exchange committed to publishing a full incident report within 24 hours, including a root-cause analysis and corrective actions. For users and market participants, those deliverables are especially important: a clear explanation of what allowed unauthorized transfers to occur—such as weaknesses in wallet controls, key management, operational procedures, or monitoring—can determine whether the incident is isolated or indicative of a broader systemic risk.

As the investigation progresses, readers should watch for whether Bitget’s promised incident report supports its claim that only hot and warm wallet layers were impacted, and whether the exchange’s address flagging results in measurable mitigation on-chain. The next few updates will likely clarify the exact mechanism of compromise and confirm when withdrawals resume.

Bitcoin has seen its largest single day net outflow from Binance since 2023, with more than 13,800 BTC leaving the exchange as the cryptocurrency holds above $84,000 following its latest rally.

CryptoQuant analyst Darkfrost said on Sept. 25 that withdrawals have dominated recent activity on Binance, which holds around 30% of the Bitcoin available across exchanges accessible to different types of investors.

The seven day average netflow has fallen to roughly negative 2,000 BTC, while Binance recorded more than 13,800 BTC in net withdrawals during the latest daily reading. The analyst described it as the exchange’s largest net outflow day in three years.

Binance’s Bitcoin reserves fell from around 705,000 BTC to 685,000 BTC over four days, removing roughly 20,000 BTC from the exchange during that period.

CryptoQuant’s chart showed the latest outflow reaching levels last seen in 2023. Bitcoin was trading near $84,300 when the data was recorded, having climbed roughly 45% from its July levels.

Binance Bitcoin outflows follow BTC break above $82,000

Bitcoin’s latest move has taken it through a price area that had previously capped its recovery.

Darkfrost said BTC has closed above its May high near $82,000 for several consecutive days, which he viewed as an important change in the market structure. Bitcoin was trading around $84,000 on Sept. 25 after recently reaching the $87,000 area.

The move followed a period of accumulation among some larger holders. Crypto.news previously reported that wallets holding 100 to 1,000 BTC had accumulated 113,950 BTC between July 15 and Sept. 24, bringing their combined holdings to approximately 5.24 million BTC. U.S. spot Bitcoin exchange traded funds recorded $346.98 million in net inflows on Sept. 23, their fifth consecutive positive session.

Demand from ETFs has changed considerably from earlier in September. Bitcoin funds finished the Sept. 14 to Sept. 18 week with just $6.1 million in net inflows after a $433 million inflow on the final trading day, while Ether funds lost roughly $140.6 million over the same week.

Binance flows have moved in the opposite direction from conditions seen earlier in the year. In May, Darkfrost reported that the exchange’s weekly average Bitcoin inflows had risen from 378 BTC to 1,190 BTC in less than 10 days, while reserves climbed by 16,000 BTC over one month.

At the time, the rise in Binance inflows coincided with pressure on Bitcoin as more coins became available on the exchange. One daily inflow exceeded 3,600 BTC on May 18.

The latest data shows that direction has reversed, with withdrawals now outweighing deposits.

What do Binance’s record Bitcoin outflows mean for BTC?

Darkfrost said dominant outflows indicate that some investors are choosing to hold Bitcoin themselves instead of leaving their coins on an exchange. He associated the behavior with longer term holding and said a decline in exchange balances mechanically reduces potential selling pressure.

Bitcoin sent away from an exchange is not necessarily being accumulated, however. Transfers can involve private custody, movements between platforms, institutional custody arrangements or other wallet activity. Exchange netflows show where coins are moving but do not establish what an owner plans to do with them.

Binance’s own reserve data provides an example of how quickly balances can change. An Aug. 1 snapshot showed that Binance users held approximately 657,000 BTC, up 16,349 BTC from the previous monthly snapshot. User holdings had already risen by 25,838 BTC in May and another 7,715 BTC in June.

CryptoQuant’s latest exchange netflow data measures a different period and shows BTC moving away from Binance during the current rally.

A similar supply pattern developed earlier this year. By May 7, nearly 100,000 BTC had left Binance, OKX and Gemini reserves since February. Binance accounted for around 50,000 BTC of that decline, with its reserves falling from nearly 670,000 BTC on Feb. 21 to approximately 620,000 BTC.

The decline across major exchanges reduced the amount of Bitcoin readily available on trading venues, although whale transfers to exchanges continued at the time. 

For the current move, Darkfrost’s interpretation depends on withdrawn coins remaining away from exchanges. Continued negative netflows would leave fewer BTC immediately available on Binance, while a return of large deposits would reverse part of the recent decline in exchange supply.

Bitcoin accumulation follows a 45% recovery from July

The timing of the latest withdrawals stands out because Bitcoin has continued to leave Binance while its price has moved higher.

According to Darkfrost Bitcoin has gained roughly 45% since its July levels, yet accumulation appears to have continued throughout the rally. He argued that some investors who had waited for another decline similar to previous bear markets may now be entering the market as the recovery continues.

He described the sudden Binance withdrawals as possible FOMO among latecomers who had expected Bitcoin to fall further.

Bitcoin exchange supply had already reached unusually low levels earlier in 2026. In May, total reserves across major exchanges fell to approximately 2.67 million BTC, a level comparable with August 2019. The decline in exchange reserves occurred while BTC traded near $73,000, although weak short term momentum and holder profitability meant lower reserves alone did not confirm a price bottom.

The latest Binance data comes with Bitcoin trading at a considerably higher level. BTC was near $84,000 on Sept. 25 after pulling back from the $87,000 area, with resistance recently forming around $86,700. 

Darkfrost said similar exchange withdrawal events could appear again if Bitcoin continues its current progression, particularly if investors who remained on the sidelines begin moving into the market.

Hyperliquid Strategies has bought another 494,200 HYPE worth $45.8 million as the company continues to build its treasury while large holders move millions of dollars worth of the token toward potential sale.

Lookonchain reported on Sept. 25 that wallet 0x6436, which it linked to Hyperliquid Strategies, made the latest purchases over a 16 hour period. The address has now accumulated 5.51 million HYPE worth roughly $476 million over the past month.

Tether has confirmed that it holds assets at offshore banking partner EQIBank, while saying the exposure represents less than 0.034% of group assets as the bank contests a major U.S. seizure.

The Information reported that Dominica-licensed EQIBank had provided banking services to Tether, including processing wire transfers connected with purchases and redemptions of USDT. Tether confirmed the relationship in a written response and said it did not know about the conduct U.S. prosecutors have alleged against payment provider Capstone Ltd.

“Tether had no knowledge of the conduct by Capstone alleged by the Department of Justice,” a Tether spokesperson told The Information. The company said assets held at EQIBank were limited to “less than 0.034% of the assets of the group.” Tether did not disclose the exact dollar amount.

Tether says its EQIBank exposure remains limited

Applying Tether’s 0.034% ceiling to its latest published quarterly asset total provides only an upper-bound reference, not a disclosed deposit balance. Tether reported $187.75 billion in assets at June 30, meaning 0.034% of that figure equals roughly $63.8 million. Tether’s actual EQIBank exposure could be lower.

The June reserve report placed liabilities at around $183.64 billion and excess reserves at $4.11 billion. USDT issuance stood near $184.6 billion at quarter-end. Tether said its reserves remained concentrated in short-duration and liquid assets, including U.S. Treasury-related holdings and repurchase agreements.

As crypto.news previously reported in its coverage of Tether’s second-quarter reserve position, the company generated roughly $1.5 billion in second-quarter operating profit while its excess reserve balance ended June at $4.11 billion. The reported buffer had fallen from $8.23 billion at the end of the first quarter.

The EQIBank issue therefore concerns one banking counterparty inside Tether’s asset base. Tether has not published a breakdown showing its total deposits across offshore banks, and the 0.034% statement applies specifically to assets held at EQIBank. No verified disclosure reviewed for this report establishes that other Tether banking relationships face the same seizure or liquidity issue.

U.S. forfeiture case targets about $84.2 million

Court documents provide a more precise picture of the assets U.S. prosecutors are seeking to forfeit. A September 14 federal court order lists approximately $79.11 million seized from a Wells Fargo Securities account held in Capstone’s name.

The same filing lists another $1.86 million from a Wells Fargo Bank account and approximately $2.06 million from a JPMorgan Chase account. Prosecutors named another 1.12 million USDT from one cryptocurrency address and 54,578.45 USDT from a second address. Combined at their dollar peg, the listed property totals roughly $84.2 million.

EQIBank has described its claimed loss differently. The bank says U.S. authorities seized approximately $89 million belonging to it through Capstone and that the amount represents around 80% of its monetary holdings. EQIBank has warned in court filings that losing access to the funds could place it at risk of liquidation.

The difference between the bank’s roughly $89 million claim and the government’s approximately $84.2 million forfeiture property should not be treated as an inconsistency that has already been resolved. EQIBank’s property claim and the government’s current forfeiture complaint use different figures and arise from separate filings.

EQIBank failed to recover funds through its first motion

EQIBank began its federal challenge on June 29 by seeking the return of property under Rule 41(g) in the U.S. District Court for the Eastern District of California. The government later filed a separate civil forfeiture complaint on July 15 involving the Capstone accounts and cryptocurrency.

During a July 16 hearing, District Judge Dale A. Drozd denied EQIBank’s return-of-property motion for lack of equitable jurisdiction after the government filed the civil forfeiture proceeding. The docket does not show that the judge decided whether EQIBank ultimately owns the seized funds or whether prosecutors are entitled to keep them.

The litigation remains active. On September 16, Judge Drozd ordered the original EQIBank matter and the government’s forfeiture action assigned to the same district and magistrate judges because the cases are related. The court expressly stated that the reassignment did not consolidate them.

A separate September 14 order requires the government to publish notice of the forfeiture action for 30 consecutive days on the federal forfeiture website. Anyone asserting an interest in the property must follow the claim procedure set out under Supplemental Rule G, after which responses to the complaint can proceed.

EQIBank maintains that it is an innocent owner of the money. In court papers quoted by The Information, the bank said “EQIBank is not a rogue bank” and said the government had not identified it as a target of the investigation. U.S. prosecutors have not adopted EQIBank’s characterization, and the forfeiture litigation has not reached a final judgment.

Tether’s latest audit provides separate reserve context

Tether completed its first full independent financial statement audit in August, covering the year ended December 31, 2025. KPMG U.S. issued an unqualified opinion on the audited financial statements, according to Tether’s August 13 announcement.

Tether said the 2025 audited statements showed reserves exceeding liabilities tied to issued tokens by $6.814 billion at year-end. KPMG examined transactions, asset ownership, valuations, counterparties, internal systems and supporting documentation, while physically inspecting Tether’s gold holdings.

As crypto.news reported in its coverage of Tether’s first full KPMG audit, the audit covered the company’s full 2025 financial statements and differed from quarterly reserve attestations that measure assets and liabilities at a specific date.

The KPMG opinion predates the June 2026 quarter-end figures and does not determine how much money Tether currently holds at EQIBank. Tether’s latest public statement on the bank gives only the percentage ceiling, while the federal proceeding concerns funds held through Capstone accounts at Wells Fargo and JPMorgan Chase.

The next procedural steps sit in the Eastern District of California forfeiture case. The September publication order gives parties claiming an interest in the seized property up to 60 days after the first day of publication to file claims, followed by a 21-day period to answer the government’s complaint or seek relief under Rule 12.

Crypto exchange Bitget suspects North Korean hackers may be behind a security breach that affected about $351.6 million in digital assets, citing preliminary evidence from an ongoing investigation.

Bitget CEO Gracy Chen said investigators identified internet protocol addresses linked to VPN services previously used by a North Korean hacking group. The pattern of the attack also resembled earlier operations attributed to the country, she said in a livestream on X earlier today.

Chen said the specific intrusion method used to enter Bitget’s systems remain under technical investigation.

Bitget detected unauthorized transfers from some wallets Thursday afternoon stateside, involving 19 transfers from parts of its hot and warm wallet infrastructure, while cold wallets remained secure, according to Chen.

Affected assets included ether, XRP, USDT, USDC, Avalanche and BNB across the Ethereum, XRP Ledger, Avalanche, BNB Smart Chain and Arbitrum networks. Earlier on-chain estimates put the outflows at about $183 million, but Bitget said those analyses had not captured activity across all affected blockchains.

The exchange’s security team found that the attacker breached a critical backend wallet system, used it to spoof transfer information and triggered Bitget’s authorization-signing process. Chen said that the breach had been contained, preventing further unauthorized outflows.

“Private key compromise has been ruled out,” she said.

Withdrawals remain suspended while technical teams repair and reinforce the affected systems, though deposits and trading continue normally.

While Chen declined to commit to a firm timetable, she said withdrawals could return within hours or days, but “shouldn’t take weeks,” in a broadcast on X a few hours after the attack.

The company maintains that customer balances are accurate and that the loss is fully covered by its User Protection Fund, which holds more than $464 million.

Bybit CEO Ben Zhou said his team was standing by to assist Bitget, which supported Bybit following its $1.5 billion hack in February 2025. Bybit is updating its LazarusBounty platform to help trace the stolen funds, Zhou added.

KelpDAO has sued LayerZero and co-founder Bryan Pellegrino in British Columbia over the April 18 exploit that drained 116,500 rsETH worth approximately $292 million.

KelpDAO said on September 24 that Evercrest Technologies Inc., the legal entity behind Kelp, filed the action to address what it describes as failures connected to LayerZero’s infrastructure. Kelp’s current terms identify Evercrest Technologies Inc. as the company providing the Kelp application.

The complaint, according to KelpDAO’s public account, alleges that LayerZero failed to disclose weaknesses and risks in its technology and failed to stop attackers from penetrating security infrastructure used by its verifier. No court has ruled on those allegations.

Pellegrino disputes the case. He called the claims “meritless” and said he would defend himself and LayerZero in Vancouver. Current reporting confirms the civil claim names both LayerZero and Pellegrino personally.

KelpDAO says LayerZero approved its bridge setup

KelpDAO’s case centers partly on the configuration of the rsETH bridge. The protocol says LayerZero had reviewed and approved its deployment and configuration in writing before the April exploit, contradicting LayerZero’s later argument that Kelp created a dangerous single-verifier setup.

LayerZero has given a different account. In its April incident statement, the company said Kelp used a 1-of-1 Decentralized Verifier Network, or DVN, leaving no separate verifier capable of rejecting a false cross-chain message. LayerZero said it had previously recommended verifier diversification and described the configuration as a single point of failure.

Kelp pushed back days after the attack. As crypto.news reported in its coverage of the dispute over LayerZero’s default configuration, Kelp said its bridge followed LayerZero’s documented defaults and relied on LayerZero-operated infrastructure. LayerZero maintained that Kelp had manually moved to the 1-of-1 configuration.

Pellegrino later said Kelp originally used multi-DVN or DeadDVN defaults before changing the rsETH deployment. Kelp has disputed LayerZero’s description of the discussions and now says its lawsuit will rely on written records showing LayerZero reviewed the setup.

LayerZero’s own infrastructure was compromised

The parties disagree over responsibility, but LayerZero’s final incident report confirms that attackers penetrated infrastructure operated by LayerZero Labs before the rsETH bridge released the funds.

LayerZero published its detailed report in May, saying the intrusion began on March 6 when an attacker socially engineered a LayerZero developer and obtained session credentials. The attacker then entered LayerZero’s RPC cloud environment and altered internal RPC nodes used by the LayerZero Labs DVN.

During the April 18 attack, the compromised nodes supplied false blockchain information while attackers launched a denial-of-service attack against external RPC providers. LayerZero’s DVN then signed a forged message because its available information indicated that the message was valid.

Kelp’s Ethereum bridge subsequently released 116,500 rsETH even though no corresponding burn had occurred on the source chain. Chainalysis described the event as an attack on off-chain verification infrastructure, not a smart contract vulnerability in Kelp’s rsETH token contract.

A second attempt sought another 40,000 rsETH, then worth roughly $95 million to $100 million, but Kelp had paused its contracts before the forged packet could execute. The pause occurred roughly 46 minutes after the successful drain.

As crypto.news reported in its LayerZero incident report coverage, LayerZero responded by ending support for 1-of-1 DVN configurations and moving affected applications toward multi-verifier setups. The company said its updated security model requires more independent verification paths.

Lawsuit follows months of competing blame

KelpDAO’s newly filed action turns a public technical dispute into a civil court case. Kelp says LayerZero and Pellegrino spent months placing responsibility on Kelp after infrastructure controlled by LayerZero was compromised.

LayerZero has maintained that the attacker could not have stolen the rsETH if Kelp had required multiple independent DVNs. Its May report said a hardened configuration requiring separate verifiers to agree would have stopped one compromised verifier from authorizing the forged message.

Security researchers have documented both parts of the failure. Blockaid found that LayerZero’s sole DVN authenticated the false cross-chain message and that the absence of a second verifier allowed it to reach Kelp’s Ethereum adapter.

Chainalysis reached a similar technical finding while focusing on the compromised infrastructure. Its investigation found attackers manipulated LayerZero-operated RPC nodes feeding the DVN and forced the verifier to rely on those nodes by disrupting external providers.

LayerZero and several researchers have attributed the attack to North Korea-linked TraderTraitor, associated with the Lazarus Group. LayerZero’s final report said Mandiant, CrowdStrike and independent researchers reached that attribution.

As crypto.news reported in its coverage of the Lazarus attribution, the finding came from LayerZero’s investigation and associated security work. The lawsuit concerns responsibility between Kelp and LayerZero for the conditions that allowed the exploit; the attribution does not resolve that civil dispute.

Kelp has moved rsETH away from LayerZero

Kelp began changing its bridge infrastructure while recovery work continued. In May, it announced a migration of rsETH cross-chain transfers from LayerZero’s OFT framework to Chainlink CCIP.

Crypto.news reported that Kelp moved rsETH toward Chainlink CCIP as the disagreement with LayerZero continued. Pellegrino disputed Kelp’s account of the original bridge configuration during that migration process.

By May 25, Kelp said it had transferred the final 20,373.72 rsETH tranche needed for its operational recovery plan. Minting, redemptions and rewards had resumed, while bridging services reopened after earlier asset transfers restored backing to the affected structure.

The recovery involved other DeFi platforms because the attacker had used stolen rsETH as collateral. Aave, Kelp and other participants organized a recovery process after the theft created losses in lending markets. As crypto.news previously reported, Kelp committed 2,000 ETH to the rsETH recovery effort as part of that process.

The civil case now moves into British Columbia’s court process. Under the province’s Supreme Court Civil Rules, a defendant generally has 21 days to respond after service in Canada, 35 days after service in the U.S., or 49 days when served elsewhere, unless the court orders another deadline. Pellegrino has publicly said he intends to contest the action in Vancouver.

Block has joined the x402 Foundation and contributed Bitcoin Lightning support to the open payment protocol used by AI agents, web services and applications.

Block’s September 24 announcement states that the company has brought Lightning payments into x402 as part of its work on agentic commerce. The payment company said Lightning fits transactions that require low costs, fast settlement and repeated small payments.

The technical addition was already visible in x402’s public development repository. A September 23 commit records “exact Lightning on lnbtc,” providing an independent public record of the Lightning specification entering the project immediately before Block disclosed its participation.

Block brings Bitcoin Lightning into x402 payments

Created by Coinbase, x402 uses the HTTP 402 “Payment Required” response to let software request and settle payments during an ordinary web interaction. A server can return payment instructions when an AI agent requests a paid API, dataset or other digital service. The agent pays and retries the request with proof of payment.

Block’s contribution introduces Bitcoin Lightning as another payment option inside that framework. The company said Lightning was designed for “instant, low-cost, high-volume payments,” though Block did not publish transaction volumes, merchant deployments or AI-agent usage figures specifically tied to its Lightning implementation.

Steve Lee, head of Block’s Bitcoin development initiative Spiral, made a forward-looking case for the technology. He said agents “will make billions of small payments,” adding that such activity would need payment rails designed for frequent, inexpensive transactions. The statement represents Block’s expectation for agentic commerce, not measured current Lightning demand.

The x402 protocol itself already carries substantial activity from existing payment methods. Its official site currently reports 75.41 million transactions, $24.24 million in volume, 94,060 buyers and 22,000 sellers during the previous 30 days. The figures cover x402 as a whole and should not be interpreted as Bitcoin Lightning statistics.

x402 moves beyond its stablecoin-heavy payment base

Stablecoins have supplied much of x402’s payment activity to date. As crypto.news reported in its coverage of stablecoin use across agent-payment activity, Circle said USDC accounted for 99.3% of x402 payment volume measured during its second quarter. Circle’s figure applied specifically to x402 activity in its data, not every AI-agent payment system.

Lightning gives developers an option that settles in Bitcoin instead of a dollar-linked token. Block described its contribution as an effort to expand the available non-card payment methods supported by an open standard. Erik Reppel, x402’s creator and a member of its Technical Steering Committee, said the protocol was designed so different networks could be added without tying the standard to one payment rail.

Recent integrations show how developers have been adding network choices to x402. Crypto.news reported this week that AI-agent payment support through x402 reached Cardano’s software stack, with an initial TypeScript release and a facilitator tested on the network’s pre-production environment. Mainnet use had not yet been demonstrated in that implementation.

Other deployments are further into production. In related coverage, crypto.news reported that autonomous payment infrastructure on Casper mainnet uses an x402 facilitator to let AI agents purchase online services through HTTP-based payments.

The XRP Ledger has generated another source of activity. As crypto.news reported, agentic payment activity on XRP Ledger passed one million x402 transactions by July, while Ripple-backed t54.ai introduced tools and directories for AI projects using the network.

Block joins a Linux Foundation-governed payment standard

Coinbase originally developed x402 before contributing it to the Linux Foundation. The Linux Foundation announced the x402 Foundation in April as a neutral body intended to oversee development of the payment standard outside the control of one vendor.

The Foundation became operational in July with 40 organizations. Its official announcement listed Amazon Web Services, Google, Coinbase, Mastercard, Visa, Stripe, Circle, Ripple, Shopify and Solana Foundation among its premier members, with other blockchain and infrastructure companies participating at different membership levels.

Microsoft requires a more precise description. The Linux Foundation’s April launch notice listed Microsoft among organizations expressing “initial intent and support” for the Foundation, but Microsoft was not included in the named 40-member operational roster published in July. The current x402 membership page does not expose member names as searchable text, so the available official material does not support describing Microsoft as a confirmed current member without qualification.

Under the Foundation model, x402 remains network and currency agnostic. The protocol puts payment instructions inside normal HTTP requests, allowing different settlement systems to plug into a common interaction between a client and server. Its official documentation says merchants can accept several networks or schemes through the same payment middleware.

Block ties x402 to its existing agentic commerce work

The x402 membership extends work Block has already pursued around autonomous software. Block said it has contributed goose, its open-source AI agent, helped establish the Agentic AI Foundation and participated in the Universal Commerce Protocol initiative.

Google describes Universal Commerce Protocol, or UCP, as an open-source standard connecting consumer-facing AI systems with merchant infrastructure. Its framework covers processes such as product discovery and checkout while allowing businesses to expose payment choices to software agents.

x402 serves a different layer. Its focus is the payment request and settlement interaction over HTTP, including cases where an autonomous application purchases a single API call or other digital resource without using a conventional checkout flow. Block said open payment rails could let sellers interact with buyers’ agents without creating a separate integration for every agent platform.

AWS has already connected x402 to commercial AI infrastructure. As crypto.news previously reported, Amazon Bedrock AgentCore’s autonomous payment integration added Coinbase x402 infrastructure for USDC transactions, allowing compatible agents to pay for services while operating inside enterprise spending and compliance controls.

The Graph has implemented the standard at the service level as well. Crypto.news reported that pay-per-request access to blockchain data lets developers and AI agents purchase individual Graph Gateway queries using x402 instead of maintaining a conventional subscription or prepaid API account.

Block has not announced a timetable for integrating Lightning-based x402 payments directly into Square, Cash App, Bitkey or its other consumer products. Its September 24 roadmap says the company will keep contributing to Lightning support, participate in x402 Foundation working groups and continue developing agentic-commerce tools that use the standard.

Researchers at Alloc Init have proposed, in a September 24 paper, private Bitcoin transfers using zero-knowledge proofs without requiring a soft fork.

Alloc Init’s researchers Clara Shikhelman, Mikhail Komarov and Aleksei Moskvin published Shielded Bitcoin as a metaprotocol that uses Bitcoin to publish and order encrypted transaction data. Bitcoin nodes would not need to understand or enforce the privacy system’s rules.

Called Shielded Bitcoin, the proposed system borrows core ideas from Zcash, including encrypted notes, nullifiers and zero-knowledge proofs. It would conceal shielded senders, receivers, transferred amounts and links to earlier notes while leaving Bitcoin’s existing consensus rules unchanged.

The proposal remains research, not deployed Bitcoin software. Alloc Init has not announced a mainnet launch date, while a separate mechanism for moving BTC into and out of the shielded system remains under development. Founder Misha Komarov described the underlying technique as experimental during an interview published September 24.

Shielded Bitcoin moves privacy checks outside consensus

Under the proposed architecture, Bitcoin would function as what the researchers describe as a neutral publication and ordering layer. A shielded transaction would place encrypted notes, nullifiers and a zero-knowledge proof into data carried by an ordinary Bitcoin transaction.

Separate programs called indexers would read the data in Bitcoin’s established transaction order. An indexer would verify the zero-knowledge proof, check whether each nullifier had appeared before and update its view of the shielded system when the transaction passes those checks. Invalid shielded data could still enter the Bitcoin blockchain because Bitcoin itself would not enforce the metaprotocol. The indexer would simply reject it from Shielded Bitcoin’s state.

A sender would consume encrypted notes representing previously received value and create new notes for recipients. The proof would establish that the sender controls valid notes, has not created value from nothing and has balanced transaction inputs and outputs without exposing the underlying amounts or notes.

As crypto.news explained in its recent guide to zero-knowledge proofs, ZK systems can prove that a computation followed specified rules without revealing the private information used in that computation. Shielded Bitcoin applies that model to Bitcoin transfers, while its indexers handle verification outside Bitcoin consensus.

A dishonest indexer could provide stale information, omit transfers or delay wallet updates, the researchers said. Such an indexer would not gain control of a user’s spending key. Users could switch indexers or independently replay the shielded transaction history from Bitcoin.

How the Zcash-style design hides transaction links

Shielded Bitcoin closely follows the note model used by Zcash. Nullifiers identify when a note has been spent without publicly revealing which encrypted note produced the nullifier, allowing an indexer to reject double spending while keeping the transaction link hidden.

Komarov characterized the concept more simply in his September interview: “It’s basically Zcash.” He said users would place bitcoin into a private pool, receive encrypted notes and later spend, split or use those notes when withdrawing. Alloc Init intends to connect that system to Bitcoin through its PIPEs research.

Privacy would not make every part of the activity invisible. Public observers could still see when a Shielded Bitcoin transaction occurred, its timing, transaction fee, data size, number of notes consumed and created, and the Bitcoin transaction carrying the encrypted information. A recognizable Bitcoin wallet used to publish those transactions could reveal further information about the publisher.

The researchers provide separate read-only keys for viewing incoming or outgoing activity. Users could disclose selected transaction information to an accountant or counterparty without surrendering spending authority, though Alloc Init cautions that sharing a complete viewing key would reveal everything covered by that key.

In related coverage, crypto.news reported this week on expanding demand for privacy-focused crypto systems. The report cited ZecStats data showing 4.91 million ZEC in Zcash shielded pools, representing 29% of issued supply at the time.

Anonymity and quantum resistance remain contested

The proposal has drawn questions over how much privacy a new shielded pool could provide at launch. Developer Vadim Zavodil argued that Zcash already has years of shielded activity behind its anonymity set, while a new Bitcoin metaprotocol would begin with few participants.

“Privacy is a function of the crowd,” Zavodil wrote, arguing that an early Shielded Bitcoin user could have very few comparable transactions to blend into. His criticism focuses on practical anonymity from user behavior and pool size, not whether the cryptographic proof itself conceals its private inputs.

Alloc Init’s own explanation acknowledges the same general limitation. A large quantity of bitcoin entering a shielded system does not by itself create a strong anonymity set if only a few actors generate most notes or if individual wallets follow recognizable deposit, withdrawal or timing patterns.

Research on Zcash has documented similar behavioral problems. A peer-reviewed 2018 study found that transaction patterns could shrink the effective anonymity set even when the underlying shielded cryptography remained intact. The study examined an older Zcash implementation and predates several later upgrades.

Post-quantum researcher Pierre-Luc Dallaire-Demers raised a separate cryptographic concern. He described the construction as interesting but “not quantum resistant at all.” In a follow-up, he said he was examining what a fully post-quantum version could require if Bitcoin eventually adopts post-quantum signatures.

Komarov has given a more conditional account. His interview with Unchained said the shielded pool’s eventual route to quantum resistance would depend partly on Bitcoin’s own signature system. Alloc Init has not presented Shielded Bitcoin as a finished post-quantum implementation.

Zerocash co-author and StarkWare CEO Eli Ben-Sasson responded more favorably to the project’s direction, while noting that he had not yet reviewed the full paper. His support therefore represented an initial reaction, not a technical endorsement of the construction.

Shielded Bitcoin still needs its Bitcoin entry and exit system

A major unfinished component is the movement of actual BTC into and out of the shielded metaprotocol. Alloc Init’s September 24 explanation says the current paper specifies shielded transfers after value is inside the system, while a forthcoming paper will describe peg-ins and peg-outs using PIPEs.

PIPEs relies on witness encryption to make access to a Bitcoin signing key conditional on proof that specified rules were followed. Komarov explained to the Bitcoin Development Mailing List in February that PIPEs v2 could emulate certain covenant and zero-knowledge verification functions without requiring a Bitcoin soft fork.

The cryptographic machinery remains computationally heavy. Komarov’s February disclosure put a PIPEs v2 ciphertext at roughly 330 TB of storage, while stating that researchers knew a route that could eventually reduce the figure toward 100 GB. The smaller target had not been achieved in that publication.

Shielded transfers would consume more Bitcoin block space as well. Komarov told Unchained that an encrypted shielded payload would run around 700 virtual bytes, compared with roughly 100 to 200 virtual bytes for a typical Bitcoin transaction. He estimated the resulting miner fee could be approximately four times higher.

No launch date has been set. Komarov said the team is gathering technical feedback while continuing work on the experimental construction, including open attempts to find faults in the design and work with witness-encryption researcher Sanjam Garg.

The next publicly scheduled presentation is set for September 28, 2026. The Bitcoin Treasuries Conference agenda lists Alloc Init researcher Clara Shikhelman for a five-minute session titled “Shielded Bitcoin: Private Transfers on Bitcoin L1” in New York.