Magic Eden has faced reports of a possible contract exploit after unusual transactions showed thousands of NFTs being sold for 0 ETH, although one account involved in the activity has claimed the transfers are part of a whitehat operation.

NFT trader Cirrus first flagged the activity on Sept. 25, saying NFTs were showing sales originating from Magic Eden and that the marketplace’s contract may have been exploited.

Cirrus later warned users who had previously interacted with Magic Eden to remove their approvals after observing someone selling thousands of NFTs to themselves for 0 ETH. The trader noted at the time that the activity could potentially be linked to a whitehat.

Magic Eden had not released an official statement confirming an exploit at the time of writing, leaving the nature and scale of the incident unclear.

Possible whitehat says NFTs are safe

Shortly after the warning, pseudonymous X user Quit claimed the activity was a whitehat operation.

Quit said assets held at 0x71cf3f5724bD2B72Ef6464992aCd26216DE7fe33 were safe and would be returned once they were no longer considered at risk.

No confirmation from Magic Eden has established that the address belongs to an authorized whitehat or that the transactions were carried out as part of a coordinated recovery effort.

Details about the vulnerability that may have allowed the transactions, how many wallets were affected and the total value of NFTs moved have not yet been disclosed.

Magic Eden had ended EVM marketplace support

The unusual Ethereum NFT activity comes months after Magic Eden changed its marketplace operations.

Crypto.news previously reported that Magic Eden ended support for its Bitcoin and EVM based NFT marketplaces earlier this year while retaining its Solana marketplace.

Magic Eden’s own support documentation states that EVM marketplace support ended on March 9. The company said listings, bids and offers on its EVM marketplace were offchain and would stop being visible or actionable after the shutdown.

The platform continues to support its Solana marketplace, while its current products include Packs, which can contain NFTs from Ethereum collections. Magic Eden says NFTs revealed through Packs can be traded on the marketplace.

Magic Eden has yet to say whether the activity reported on Sept. 25 affected any of those services or involved contracts associated with its discontinued EVM marketplace.

(This is a developing story.)

The US 10-year Treasury yield has reached 5.2% during trading, raising questions about whether crypto can hold its recent gains while another Federal Reserve rate hike remains possible and a major US digital asset bill is stalled.

The US Treasury recorded a 10-year yield of 5.18% on Sept. 24, up from 5.11% a day earlier. The 30-year yield closed at 5.47%, its highest level since 2004. The 10-year yield reached 5.20% during the session before ending below that level.

Bitcoin traded around $84,000 after retreating from the $87,000 area earlier in the week. The pullback has been limited so far, but higher bond yields have arrived at a time when investors are watching whether recent buying through US spot Bitcoin funds will continue.

Why are Treasury yields rising?

Oil prices climbed on Sept. 24 after a Houthi missile attack on Saudi Arabia renewed concerns about supply. Brent crude futures settled at $106.60 a barrel, up $3.52, while West Texas Intermediate crude finished at $94.61, up $2.45. Prices eased from their intraday highs following reports of US-Iran discussions about reopening the Strait of Hormuz.

Higher energy costs have kept inflation in focus for the Federal Reserve. Philadelphia Fed President Anna Paulson said on Sept. 24 that underlying inflation was running around 2.5% to 3%, above the central bank’s 2% target. Paulson supported last week’s quarter-point rate hike and said modest further tightening may be warranted if economic conditions develop as she expects.

New York Fed President John Williams described another hike before the end of the year as a reasonable expectation, though he said the decision would depend on incoming data. The Fed raised its benchmark rate to a range of 3.75% to 4.00% on Sept. 16, and its latest projections indicated that another increase could follow this year.

Recent economic figures have done little to settle the question. Initial claims for unemployment benefits fell to 197,000 in the week ended Sept. 19, according to the Labor Department. S&P Global’s preliminary US composite purchasing managers’ index rose from 56.0 in August to 58.4 in September, pointing to the fastest growth in business activity in more than five years.

The Census Bureau estimated that August new home sales rose 6.4% from July. Its stated margin of error was wider than the reported monthly change, so that estimate alone does not establish a firm rise in housing demand.

Can crypto hold up while bond yields climb?

A 10-year Treasury yield near 5.2% gives investors a higher return on US government debt at the same time that further Fed tightening remains under discussion. Bitcoin’s response has been mixed. It rallied after the Sept. 16 rate hike and moved above $82,000 this week, but later fell back from the $87,000 area.

As  previously reported by crypto.news, wallets holding 100 to 1,000 BTC had accumulated 113,950 BTC between July 15 and Sept. 24. US spot Bitcoin exchange-traded funds recorded their fifth consecutive session of net inflows on Sept. 23. Both figures point to buying during the rally, though neither establishes how investors will respond if yields continue to rise.

Demand through the funds has varied considerably this month. Bitcoin ETFs ended the Sept. 14 to Sept. 18 week with roughly $6.1 million in net inflows despite taking in $433 million on its final trading day. The subsequent run of positive sessions accompanied Bitcoin’s move higher. HashKey Group senior researcher Tim Sun said short-term ETF flows often follow Bitcoin’s price instead of reliably predicting its next move.

Buying after the Fed decision came from several parts of the market, including spot investors, ETF buyers and traders closing short positions. The rally showed that last week’s rate increase did not prevent Bitcoin from gaining. Its retreat from $87,000 leaves the durability of that demand open to another test as Treasury yields rise.

US shares offered little indication of a broad selloff on Sept. 24. The S&P 500 slipped 0.02%, the Nasdaq Composite gained 0.01% and the Dow Jones Industrial Average fell 0.31%, despite the rise in borrowing costs.

Regulatory uncertainty remains another pressure point

Higher Treasury yields are testing demand for crypto just as the industry faces a longer wait for US market rules. The Senate failed to advance the Digital Asset Market Clarity Act on Sept. 15, with 49 senators voting for the procedural motion and 50 against. It needed 60 votes to proceed. The bill would define how the Securities and Exchange Commission and the Commodity Futures Trading Commission oversee digital asset markets.

The vote did not stop Bitcoin’s subsequent rally, but it left firms and investors without the legislation they had expected Congress to consider. Seven Senate Democrats reopened negotiations after the vote, though no new vote has been secured. Fireblocks US policy director Jessica Martinez said companies would continue developing products without the bill, while legislation would give them rules with more staying power than agency decisions.

Regulators have continued work as the market weighs the prospect of another Fed hike. The CFTC submitted proposed crypto market rules for White House review on Sept. 18, a step that precedes any commission vote or public comment period. The SEC has issued an exemption for certain tokenized securities activity. Neither action resolves the Senate bill, leaving the timing of a federal market structure law unsettled while crypto investors assess higher yields.

Bitcoin traded just above $84,000 on Friday, flat over 24 hours after falling below that level on Wednesday, CoinDesk data show. Most major tokens moved less than 2%. Smaller names did the running, with ONDO up 27% to about 54 cents and Quant up 39% to nearly $100.

Bonds found a floor in Asia. The 10-year Treasury yield slipped two basis points to 5.17% after jumping more than 20 basis points over the previous two sessions, and Brent fell 1% to about $105 a barrel on reports that Washington and Tehran are exploring a phased deal to reopen the Strait of Hormuz.

FxPro chief market analyst Alex Kuptsikevich reads bitcoin’s drop as a stall short of the target technical traders had projected for the rally that began in mid-August.

“As with the overall market capitalisation, the leading cryptocurrency encountered resistance near a previously significant support level. However, BTC failed to complete the Fibonacci extension pattern to 161.8% of the impulse that began in mid-August in a single move. Despite the pullback, the ongoing, unfinished nature of the uptrend suggests it may be a temporary pause on the way up,” he said in a note.

“It is worth remembering that in 2021, Bitcoin lost over 50% from its peak before reaching new highs. Similarly, today, a decline to $70K may be painful for short-term speculators, but it does not undermine the bullish outlook,” he added.

Bitcoin heads into Friday’s Deribit expiry below $85,000, the strike carrying one of the largest blocks of call options.

Bitcoin has held near $84,000 after twice failing to sustain moves above $87,000, while ETF inflows, whale accumulation and falling exchange balances continue beneath the price consolidation.

CoinGecko shows Bitcoin near $84,403 at the latest check, with a 24-hour range between $82,941 and $84,843. BTC has gained roughly 10.3% over seven days, keeping most of its rebound from last week’s low near $75,000.

The current pause follows a sharp reversal from September 16, when the Federal Reserve raised its target rate by 25 basis points to 3.75%–4.00%. One day earlier, Senate cloture on the CLARITY Act failed 49–50, short of the 60 votes needed to advance the bill.

BTC briefly traded close to $75,000 around those events before recovering above $80,000 and reaching $87,392 on September 21. The price has since retreated toward $84,000, leaving traders to assess whether demand behind the rebound remains strong enough for another attempt higher.

Why is Bitcoin price holding near $84K?

Bitcoin’s latest rejection came from the 86,000–87,000 zone, which has now stopped the price more than once. Crypto.news previously identified the $86,700 Bitcoin resistance and $82,000 support setup after the asset returned from its eight-month high.

Rekt Capital said BTC needs to stay above roughly $82,000, or successfully retest the level during another correction, to avoid falling back into its former 60,000–80,000 trading range. Bitfinex separately identified 85,000–86,500 as a dense buyer cost area after the latest rally.

The chart’s Bull Bear Power reading remains near +4,790. A positive BBP figure means bulls still exert more pressure than bears, though the latest histogram bars have fallen from their recent peak. Momentum therefore remains positive but weaker than during the surge through $82,000.

Chaikin Money Flow gives a less aggressive reading. CMF sits around 0.00 after recovering from negative territory, leaving buying and selling pressure close to balanced. A sustained move above zero would provide stronger volume-based evidence of accumulation, while another move below zero would show capital flow weakening as BTC tests support.

The combination leaves price momentum stronger than money flow. BBP continues to favor buyers, but CMF has not confirmed persistent buying pressure behind the move toward $87,000.

ETF inflows continue even as BTC consolidates

U.S. spot Bitcoin ETFs recorded another $191 million in net inflows on September 24, extending their positive streak to six trading sessions, according to SoSoValue data. BlackRock’s IBIT led the session with approximately $163 million, while Fidelity’s FBTC received $12.86 million.

The latest figure follows much larger subscriptions earlier in the week. Funds received approximately $999 million on September 21, $714.7 million on September 22 and $346.98 million on September 23. 

ETF flows had moved in the opposite direction around the Fed meeting. U.S. funds lost approximately $746.3 million across September 15 and 16 before demand returned, according to crypto.news’ analysis of who bought Bitcoin after the Fed rate hike.

The September 24 inflow brings the current streak to six sessions even though BTC has pulled back from $87,000. SoSoValue data reported through current coverage put cumulative U.S. spot Bitcoin ETF inflows near $57.41 billion, with net assets around $108.9 billion.

Are Bitcoin whales buying the pullback?

Large-holder activity has stayed active during the retreat. Crypto analyst Ali Martinez reported that large entities accumulated approximately 30,269 BTC during a 96-hour period, worth roughly $2.57 billion at the prices used in his calculation.

His estimate covers a period when Bitcoin fell around 5.24%, from approximately $87,400 to $82,800. The accumulation figure comes from on-chain wallet analysis and does not establish the identities of the entities buying the coins.

A separate Santiment dataset showed sustained accumulation before the latest correction. Wallets holding 100–1,000 BTC added 113,950 BTC between July 15 and September 23, increasing their combined holdings to roughly 5.24 million BTC. 

Wallet cohorts do not map directly to individual investors. One institution may control several addresses, while exchanges, custodians and funds can consolidate or separate holdings. The figures document changes in wallet balances without proving who ultimately owns each position.

Binance outflows add another signal below $87K

Exchange balances have moved in the same direction as large-wallet accumulation. CryptoQuant contributor Darkfost reported more than 13,800 BTC in net withdrawals from Binance during a single day, the exchange’s biggest daily net outflow since 2023.

Recent Binance netflows have averaged around negative 2,000 BTC per week, while the exchange’s Bitcoin holdings fell from approximately 705,000 BTC to 685,000 BTC within four days. Darkfost interpreted the withdrawals as accumulation because coins leaving an exchange may be moved into personal or institutional custody.

Exchange withdrawals do not prove that holders will keep their BTC or that prices must rise. Coins can leave an exchange for custody transfers, collateral use, over-the-counter transactions or other purposes. Darkfost’s interpretation remains an analyst assessment of the flow data.

CryptoQuant contributor Amr Taha reported a similar pattern across several venues from September 22 through September 24. His figures put combined negative netflows from Binance, Coinbase, Kraken and Bitfinex at roughly $2.52 billion over the three-day period.

The reported flows included approximately $1.57 billion in combined withdrawals on September 22, $438 million the following day and $511 million on September 24. The withdrawals continued while Bitcoin slipped from roughly $87,400 toward $84,000.

Is a Bitcoin breakout coming before October?

The first technical hurdle remains the same area that rejected BTC twice this week. A recovery through roughly $86,700 would return Bitcoin to the upper end of its recent range, while $87,392 remains the latest eight-month high. Crypto.news’ Bitcoin ETF and $86,000 breakout analysis previously identified returning fund demand and short covering as contributors to the rally.

October seasonality provides another data point, though historical returns cannot establish the next move. CoinGlass data tracks Bitcoin’s monthly performance, while historical records show October finished higher in 10 of the 13 years from 2013 through 2025.

Ali Martinez has cited the same 10-of-13 record while describing the approaching month as a possible “Uptober.” The pattern remains backward-looking: Bitcoin broke the streak in October 2025, when the asset finished the month around 3.9% lower.

Crypto exchange Bitget has confirmed that it detected unauthorized transfers tied to a security breach and has temporarily suspended withdrawals while it investigates. The exchange said the incident impacted assets totaling about $351.6 million, affecting a limited set of hot-wallet holdings.

Bitget reported that its systems identified the suspicious activity at 18:31 UTC on Thursday, triggering emergency response measures. In an effort to contain the damage, the company said the breach was limited to certain hot and warm wallet layers, while cold wallets remained secure.

Key takeaways

• Bitget says unauthorized transfers impacted approximately $351.6 million and were traced to a limited number of hot wallets.
• The exchange temporarily suspended withdrawals and is conducting a security review after detecting activity at 18:31 UTC.
• CEO Gracy Chen said affected funds were primarily concentrated on Ethereum, with other networks including XRP Ledger, Avalanche, BNB Smart Chain, and Arbitrum also involved.
• Bitget stated that user balances remain accurate and that deposits and trading continue normally.
• Chen said affected assets are more than covered by Bitget’s User Protection Fund, which the exchange says holds more than $464 million.

Unauthorized transfers detected in hot-wallet layers

In a statement posted on X, Bitget said its security monitoring systems detected unauthorized transfers originating from a small number of hot wallets. The firm linked the activity to emergency response procedures initiated immediately after the alert, with the incident date and time cited as 18:31 UTC on Thursday.

Speaking directly in a live Q&A, CEO Gracy Chen emphasized that the breach was contained to a portion of the exchange’s hot and warm wallet infrastructure. She also said Bitget’s cold wallets were not compromised.

According to Chen, the stolen or affected assets included Ether (ETH), XRP (XRP), USDt (USDT), USDC (USDC), Avalanche (AVAX), BNB (BNB), and USDT0 (USDT0) on Arbitrum. She attributed the largest concentration of observed stolen funds to Ethereum.

Multiple chains involved, with Ethereum the main concentration

Chen named several networks as affected, including Ethereum, the XRP Ledger, Avalanche, BNB Smart Chain, and Arbitrum. While Bitget highlighted Ethereum as the primary venue for the observed stolen funds, the exchange also reported activity across other ecosystems, suggesting the attacker or attackers operated across multiple wallet and chain configurations rather than a single isolated target.

Bitget’s communications also acknowledged how early onchain reporting differed from later disclosures. Chen said early onchain monitoring captured a smaller amount than what Bitget later reported because the incident extended beyond the Ethereum activity reflected in those initial traces. That distinction matters for traders and users because estimates of breach scope can change as investigators widen the analysis window and broaden the search beyond the first chain clusters detected.

Withdrawals paused; deposits and trading continue

Bitget said it has temporarily suspended withdrawals as part of its security review. Chen indicated that she expected withdrawals to resume within hours or days, framing the pause as a precaution while the exchange verifies controls and assesses the extent of the unauthorized movement.

At the same time, Bitget told users that account balances remain accurate. The exchange also said deposits and trading are operating normally, a key operational detail for customers who might otherwise anticipate a full platform halt during a security incident.

The exchange said it has flagged addresses associated with the transfers and has reached out to law enforcement as well as onchain security firms, aligning with the typical process exchanges follow in response to suspected theft—identify suspect sources, trace downstream movements, and coordinate takedown or mitigation efforts where possible.

User Protection Fund to cover affected assets

Beyond containment and monitoring, Bitget addressed customer risk directly by referencing its User Protection Fund. Chen said the affected funds are more than covered by the fund, which the exchange stated currently holds more than $464 million.

Bitget also said it would provide hourly updates to reflect its ongoing investigation. In addition, the exchange committed to publishing a full incident report within 24 hours, including a root-cause analysis and corrective actions. For users and market participants, those deliverables are especially important: a clear explanation of what allowed unauthorized transfers to occur—such as weaknesses in wallet controls, key management, operational procedures, or monitoring—can determine whether the incident is isolated or indicative of a broader systemic risk.

As the investigation progresses, readers should watch for whether Bitget’s promised incident report supports its claim that only hot and warm wallet layers were impacted, and whether the exchange’s address flagging results in measurable mitigation on-chain. The next few updates will likely clarify the exact mechanism of compromise and confirm when withdrawals resume.

Bitcoin has seen its largest single day net outflow from Binance since 2023, with more than 13,800 BTC leaving the exchange as the cryptocurrency holds above $84,000 following its latest rally.

CryptoQuant analyst Darkfrost said on Sept. 25 that withdrawals have dominated recent activity on Binance, which holds around 30% of the Bitcoin available across exchanges accessible to different types of investors.

The seven day average netflow has fallen to roughly negative 2,000 BTC, while Binance recorded more than 13,800 BTC in net withdrawals during the latest daily reading. The analyst described it as the exchange’s largest net outflow day in three years.

Binance’s Bitcoin reserves fell from around 705,000 BTC to 685,000 BTC over four days, removing roughly 20,000 BTC from the exchange during that period.

CryptoQuant’s chart showed the latest outflow reaching levels last seen in 2023. Bitcoin was trading near $84,300 when the data was recorded, having climbed roughly 45% from its July levels.

Binance Bitcoin outflows follow BTC break above $82,000

Bitcoin’s latest move has taken it through a price area that had previously capped its recovery.

Darkfrost said BTC has closed above its May high near $82,000 for several consecutive days, which he viewed as an important change in the market structure. Bitcoin was trading around $84,000 on Sept. 25 after recently reaching the $87,000 area.

The move followed a period of accumulation among some larger holders. Crypto.news previously reported that wallets holding 100 to 1,000 BTC had accumulated 113,950 BTC between July 15 and Sept. 24, bringing their combined holdings to approximately 5.24 million BTC. U.S. spot Bitcoin exchange traded funds recorded $346.98 million in net inflows on Sept. 23, their fifth consecutive positive session.

Demand from ETFs has changed considerably from earlier in September. Bitcoin funds finished the Sept. 14 to Sept. 18 week with just $6.1 million in net inflows after a $433 million inflow on the final trading day, while Ether funds lost roughly $140.6 million over the same week.

Binance flows have moved in the opposite direction from conditions seen earlier in the year. In May, Darkfrost reported that the exchange’s weekly average Bitcoin inflows had risen from 378 BTC to 1,190 BTC in less than 10 days, while reserves climbed by 16,000 BTC over one month.

At the time, the rise in Binance inflows coincided with pressure on Bitcoin as more coins became available on the exchange. One daily inflow exceeded 3,600 BTC on May 18.

The latest data shows that direction has reversed, with withdrawals now outweighing deposits.

What do Binance’s record Bitcoin outflows mean for BTC?

Darkfrost said dominant outflows indicate that some investors are choosing to hold Bitcoin themselves instead of leaving their coins on an exchange. He associated the behavior with longer term holding and said a decline in exchange balances mechanically reduces potential selling pressure.

Bitcoin sent away from an exchange is not necessarily being accumulated, however. Transfers can involve private custody, movements between platforms, institutional custody arrangements or other wallet activity. Exchange netflows show where coins are moving but do not establish what an owner plans to do with them.

Binance’s own reserve data provides an example of how quickly balances can change. An Aug. 1 snapshot showed that Binance users held approximately 657,000 BTC, up 16,349 BTC from the previous monthly snapshot. User holdings had already risen by 25,838 BTC in May and another 7,715 BTC in June.

CryptoQuant’s latest exchange netflow data measures a different period and shows BTC moving away from Binance during the current rally.

A similar supply pattern developed earlier this year. By May 7, nearly 100,000 BTC had left Binance, OKX and Gemini reserves since February. Binance accounted for around 50,000 BTC of that decline, with its reserves falling from nearly 670,000 BTC on Feb. 21 to approximately 620,000 BTC.

The decline across major exchanges reduced the amount of Bitcoin readily available on trading venues, although whale transfers to exchanges continued at the time. 

For the current move, Darkfrost’s interpretation depends on withdrawn coins remaining away from exchanges. Continued negative netflows would leave fewer BTC immediately available on Binance, while a return of large deposits would reverse part of the recent decline in exchange supply.

Bitcoin accumulation follows a 45% recovery from July

The timing of the latest withdrawals stands out because Bitcoin has continued to leave Binance while its price has moved higher.

According to Darkfrost Bitcoin has gained roughly 45% since its July levels, yet accumulation appears to have continued throughout the rally. He argued that some investors who had waited for another decline similar to previous bear markets may now be entering the market as the recovery continues.

He described the sudden Binance withdrawals as possible FOMO among latecomers who had expected Bitcoin to fall further.

Bitcoin exchange supply had already reached unusually low levels earlier in 2026. In May, total reserves across major exchanges fell to approximately 2.67 million BTC, a level comparable with August 2019. The decline in exchange reserves occurred while BTC traded near $73,000, although weak short term momentum and holder profitability meant lower reserves alone did not confirm a price bottom.

The latest Binance data comes with Bitcoin trading at a considerably higher level. BTC was near $84,000 on Sept. 25 after pulling back from the $87,000 area, with resistance recently forming around $86,700. 

Darkfrost said similar exchange withdrawal events could appear again if Bitcoin continues its current progression, particularly if investors who remained on the sidelines begin moving into the market.

Tether has confirmed that it holds assets at offshore banking partner EQIBank, while saying the exposure represents less than 0.034% of group assets as the bank contests a major U.S. seizure.

The Information reported that Dominica-licensed EQIBank had provided banking services to Tether, including processing wire transfers connected with purchases and redemptions of USDT. Tether confirmed the relationship in a written response and said it did not know about the conduct U.S. prosecutors have alleged against payment provider Capstone Ltd.

“Tether had no knowledge of the conduct by Capstone alleged by the Department of Justice,” a Tether spokesperson told The Information. The company said assets held at EQIBank were limited to “less than 0.034% of the assets of the group.” Tether did not disclose the exact dollar amount.

Tether says its EQIBank exposure remains limited

Applying Tether’s 0.034% ceiling to its latest published quarterly asset total provides only an upper-bound reference, not a disclosed deposit balance. Tether reported $187.75 billion in assets at June 30, meaning 0.034% of that figure equals roughly $63.8 million. Tether’s actual EQIBank exposure could be lower.

The June reserve report placed liabilities at around $183.64 billion and excess reserves at $4.11 billion. USDT issuance stood near $184.6 billion at quarter-end. Tether said its reserves remained concentrated in short-duration and liquid assets, including U.S. Treasury-related holdings and repurchase agreements.

As crypto.news previously reported in its coverage of Tether’s second-quarter reserve position, the company generated roughly $1.5 billion in second-quarter operating profit while its excess reserve balance ended June at $4.11 billion. The reported buffer had fallen from $8.23 billion at the end of the first quarter.

The EQIBank issue therefore concerns one banking counterparty inside Tether’s asset base. Tether has not published a breakdown showing its total deposits across offshore banks, and the 0.034% statement applies specifically to assets held at EQIBank. No verified disclosure reviewed for this report establishes that other Tether banking relationships face the same seizure or liquidity issue.

U.S. forfeiture case targets about $84.2 million

Court documents provide a more precise picture of the assets U.S. prosecutors are seeking to forfeit. A September 14 federal court order lists approximately $79.11 million seized from a Wells Fargo Securities account held in Capstone’s name.

The same filing lists another $1.86 million from a Wells Fargo Bank account and approximately $2.06 million from a JPMorgan Chase account. Prosecutors named another 1.12 million USDT from one cryptocurrency address and 54,578.45 USDT from a second address. Combined at their dollar peg, the listed property totals roughly $84.2 million.

EQIBank has described its claimed loss differently. The bank says U.S. authorities seized approximately $89 million belonging to it through Capstone and that the amount represents around 80% of its monetary holdings. EQIBank has warned in court filings that losing access to the funds could place it at risk of liquidation.

The difference between the bank’s roughly $89 million claim and the government’s approximately $84.2 million forfeiture property should not be treated as an inconsistency that has already been resolved. EQIBank’s property claim and the government’s current forfeiture complaint use different figures and arise from separate filings.

EQIBank failed to recover funds through its first motion

EQIBank began its federal challenge on June 29 by seeking the return of property under Rule 41(g) in the U.S. District Court for the Eastern District of California. The government later filed a separate civil forfeiture complaint on July 15 involving the Capstone accounts and cryptocurrency.

During a July 16 hearing, District Judge Dale A. Drozd denied EQIBank’s return-of-property motion for lack of equitable jurisdiction after the government filed the civil forfeiture proceeding. The docket does not show that the judge decided whether EQIBank ultimately owns the seized funds or whether prosecutors are entitled to keep them.

The litigation remains active. On September 16, Judge Drozd ordered the original EQIBank matter and the government’s forfeiture action assigned to the same district and magistrate judges because the cases are related. The court expressly stated that the reassignment did not consolidate them.

A separate September 14 order requires the government to publish notice of the forfeiture action for 30 consecutive days on the federal forfeiture website. Anyone asserting an interest in the property must follow the claim procedure set out under Supplemental Rule G, after which responses to the complaint can proceed.

EQIBank maintains that it is an innocent owner of the money. In court papers quoted by The Information, the bank said “EQIBank is not a rogue bank” and said the government had not identified it as a target of the investigation. U.S. prosecutors have not adopted EQIBank’s characterization, and the forfeiture litigation has not reached a final judgment.

Tether’s latest audit provides separate reserve context

Tether completed its first full independent financial statement audit in August, covering the year ended December 31, 2025. KPMG U.S. issued an unqualified opinion on the audited financial statements, according to Tether’s August 13 announcement.

Tether said the 2025 audited statements showed reserves exceeding liabilities tied to issued tokens by $6.814 billion at year-end. KPMG examined transactions, asset ownership, valuations, counterparties, internal systems and supporting documentation, while physically inspecting Tether’s gold holdings.

As crypto.news reported in its coverage of Tether’s first full KPMG audit, the audit covered the company’s full 2025 financial statements and differed from quarterly reserve attestations that measure assets and liabilities at a specific date.

The KPMG opinion predates the June 2026 quarter-end figures and does not determine how much money Tether currently holds at EQIBank. Tether’s latest public statement on the bank gives only the percentage ceiling, while the federal proceeding concerns funds held through Capstone accounts at Wells Fargo and JPMorgan Chase.

The next procedural steps sit in the Eastern District of California forfeiture case. The September publication order gives parties claiming an interest in the seized property up to 60 days after the first day of publication to file claims, followed by a 21-day period to answer the government’s complaint or seek relief under Rule 12.

Crypto exchange Bitget suspects North Korean hackers may be behind a security breach that affected about $351.6 million in digital assets, citing preliminary evidence from an ongoing investigation.

Bitget CEO Gracy Chen said investigators identified internet protocol addresses linked to VPN services previously used by a North Korean hacking group. The pattern of the attack also resembled earlier operations attributed to the country, she said in a livestream on X earlier today.

Chen said the specific intrusion method used to enter Bitget’s systems remain under technical investigation.

Bitget detected unauthorized transfers from some wallets Thursday afternoon stateside, involving 19 transfers from parts of its hot and warm wallet infrastructure, while cold wallets remained secure, according to Chen.

Affected assets included ether, XRP, USDT, USDC, Avalanche and BNB across the Ethereum, XRP Ledger, Avalanche, BNB Smart Chain and Arbitrum networks. Earlier on-chain estimates put the outflows at about $183 million, but Bitget said those analyses had not captured activity across all affected blockchains.

The exchange’s security team found that the attacker breached a critical backend wallet system, used it to spoof transfer information and triggered Bitget’s authorization-signing process. Chen said that the breach had been contained, preventing further unauthorized outflows.

“Private key compromise has been ruled out,” she said.

Withdrawals remain suspended while technical teams repair and reinforce the affected systems, though deposits and trading continue normally.

While Chen declined to commit to a firm timetable, she said withdrawals could return within hours or days, but “shouldn’t take weeks,” in a broadcast on X a few hours after the attack.

The company maintains that customer balances are accurate and that the loss is fully covered by its User Protection Fund, which holds more than $464 million.

Bybit CEO Ben Zhou said his team was standing by to assist Bitget, which supported Bybit following its $1.5 billion hack in February 2025. Bybit is updating its LazarusBounty platform to help trace the stolen funds, Zhou added.

KelpDAO has sued LayerZero and co-founder Bryan Pellegrino in British Columbia over the April 18 exploit that drained 116,500 rsETH worth approximately $292 million.

KelpDAO said on September 24 that Evercrest Technologies Inc., the legal entity behind Kelp, filed the action to address what it describes as failures connected to LayerZero’s infrastructure. Kelp’s current terms identify Evercrest Technologies Inc. as the company providing the Kelp application.

The complaint, according to KelpDAO’s public account, alleges that LayerZero failed to disclose weaknesses and risks in its technology and failed to stop attackers from penetrating security infrastructure used by its verifier. No court has ruled on those allegations.

Pellegrino disputes the case. He called the claims “meritless” and said he would defend himself and LayerZero in Vancouver. Current reporting confirms the civil claim names both LayerZero and Pellegrino personally.

KelpDAO says LayerZero approved its bridge setup

KelpDAO’s case centers partly on the configuration of the rsETH bridge. The protocol says LayerZero had reviewed and approved its deployment and configuration in writing before the April exploit, contradicting LayerZero’s later argument that Kelp created a dangerous single-verifier setup.

LayerZero has given a different account. In its April incident statement, the company said Kelp used a 1-of-1 Decentralized Verifier Network, or DVN, leaving no separate verifier capable of rejecting a false cross-chain message. LayerZero said it had previously recommended verifier diversification and described the configuration as a single point of failure.

Kelp pushed back days after the attack. As crypto.news reported in its coverage of the dispute over LayerZero’s default configuration, Kelp said its bridge followed LayerZero’s documented defaults and relied on LayerZero-operated infrastructure. LayerZero maintained that Kelp had manually moved to the 1-of-1 configuration.

Pellegrino later said Kelp originally used multi-DVN or DeadDVN defaults before changing the rsETH deployment. Kelp has disputed LayerZero’s description of the discussions and now says its lawsuit will rely on written records showing LayerZero reviewed the setup.

LayerZero’s own infrastructure was compromised

The parties disagree over responsibility, but LayerZero’s final incident report confirms that attackers penetrated infrastructure operated by LayerZero Labs before the rsETH bridge released the funds.

LayerZero published its detailed report in May, saying the intrusion began on March 6 when an attacker socially engineered a LayerZero developer and obtained session credentials. The attacker then entered LayerZero’s RPC cloud environment and altered internal RPC nodes used by the LayerZero Labs DVN.

During the April 18 attack, the compromised nodes supplied false blockchain information while attackers launched a denial-of-service attack against external RPC providers. LayerZero’s DVN then signed a forged message because its available information indicated that the message was valid.

Kelp’s Ethereum bridge subsequently released 116,500 rsETH even though no corresponding burn had occurred on the source chain. Chainalysis described the event as an attack on off-chain verification infrastructure, not a smart contract vulnerability in Kelp’s rsETH token contract.

A second attempt sought another 40,000 rsETH, then worth roughly $95 million to $100 million, but Kelp had paused its contracts before the forged packet could execute. The pause occurred roughly 46 minutes after the successful drain.

As crypto.news reported in its LayerZero incident report coverage, LayerZero responded by ending support for 1-of-1 DVN configurations and moving affected applications toward multi-verifier setups. The company said its updated security model requires more independent verification paths.

Lawsuit follows months of competing blame

KelpDAO’s newly filed action turns a public technical dispute into a civil court case. Kelp says LayerZero and Pellegrino spent months placing responsibility on Kelp after infrastructure controlled by LayerZero was compromised.

LayerZero has maintained that the attacker could not have stolen the rsETH if Kelp had required multiple independent DVNs. Its May report said a hardened configuration requiring separate verifiers to agree would have stopped one compromised verifier from authorizing the forged message.

Security researchers have documented both parts of the failure. Blockaid found that LayerZero’s sole DVN authenticated the false cross-chain message and that the absence of a second verifier allowed it to reach Kelp’s Ethereum adapter.

Chainalysis reached a similar technical finding while focusing on the compromised infrastructure. Its investigation found attackers manipulated LayerZero-operated RPC nodes feeding the DVN and forced the verifier to rely on those nodes by disrupting external providers.

LayerZero and several researchers have attributed the attack to North Korea-linked TraderTraitor, associated with the Lazarus Group. LayerZero’s final report said Mandiant, CrowdStrike and independent researchers reached that attribution.

As crypto.news reported in its coverage of the Lazarus attribution, the finding came from LayerZero’s investigation and associated security work. The lawsuit concerns responsibility between Kelp and LayerZero for the conditions that allowed the exploit; the attribution does not resolve that civil dispute.

Kelp has moved rsETH away from LayerZero

Kelp began changing its bridge infrastructure while recovery work continued. In May, it announced a migration of rsETH cross-chain transfers from LayerZero’s OFT framework to Chainlink CCIP.

Crypto.news reported that Kelp moved rsETH toward Chainlink CCIP as the disagreement with LayerZero continued. Pellegrino disputed Kelp’s account of the original bridge configuration during that migration process.

By May 25, Kelp said it had transferred the final 20,373.72 rsETH tranche needed for its operational recovery plan. Minting, redemptions and rewards had resumed, while bridging services reopened after earlier asset transfers restored backing to the affected structure.

The recovery involved other DeFi platforms because the attacker had used stolen rsETH as collateral. Aave, Kelp and other participants organized a recovery process after the theft created losses in lending markets. As crypto.news previously reported, Kelp committed 2,000 ETH to the rsETH recovery effort as part of that process.

The civil case now moves into British Columbia’s court process. Under the province’s Supreme Court Civil Rules, a defendant generally has 21 days to respond after service in Canada, 35 days after service in the U.S., or 49 days when served elsewhere, unless the court orders another deadline. Pellegrino has publicly said he intends to contest the action in Vancouver.