Tether has confirmed that it holds assets at offshore banking partner EQIBank, while saying the exposure represents less than 0.034% of group assets as the bank contests a major U.S. seizure.

The Information reported that Dominica-licensed EQIBank had provided banking services to Tether, including processing wire transfers connected with purchases and redemptions of USDT. Tether confirmed the relationship in a written response and said it did not know about the conduct U.S. prosecutors have alleged against payment provider Capstone Ltd.

“Tether had no knowledge of the conduct by Capstone alleged by the Department of Justice,” a Tether spokesperson told The Information. The company said assets held at EQIBank were limited to “less than 0.034% of the assets of the group.” Tether did not disclose the exact dollar amount.

Tether says its EQIBank exposure remains limited

Applying Tether’s 0.034% ceiling to its latest published quarterly asset total provides only an upper-bound reference, not a disclosed deposit balance. Tether reported $187.75 billion in assets at June 30, meaning 0.034% of that figure equals roughly $63.8 million. Tether’s actual EQIBank exposure could be lower.

The June reserve report placed liabilities at around $183.64 billion and excess reserves at $4.11 billion. USDT issuance stood near $184.6 billion at quarter-end. Tether said its reserves remained concentrated in short-duration and liquid assets, including U.S. Treasury-related holdings and repurchase agreements.

As crypto.news previously reported in its coverage of Tether’s second-quarter reserve position, the company generated roughly $1.5 billion in second-quarter operating profit while its excess reserve balance ended June at $4.11 billion. The reported buffer had fallen from $8.23 billion at the end of the first quarter.

The EQIBank issue therefore concerns one banking counterparty inside Tether’s asset base. Tether has not published a breakdown showing its total deposits across offshore banks, and the 0.034% statement applies specifically to assets held at EQIBank. No verified disclosure reviewed for this report establishes that other Tether banking relationships face the same seizure or liquidity issue.

U.S. forfeiture case targets about $84.2 million

Court documents provide a more precise picture of the assets U.S. prosecutors are seeking to forfeit. A September 14 federal court order lists approximately $79.11 million seized from a Wells Fargo Securities account held in Capstone’s name.

The same filing lists another $1.86 million from a Wells Fargo Bank account and approximately $2.06 million from a JPMorgan Chase account. Prosecutors named another 1.12 million USDT from one cryptocurrency address and 54,578.45 USDT from a second address. Combined at their dollar peg, the listed property totals roughly $84.2 million.

EQIBank has described its claimed loss differently. The bank says U.S. authorities seized approximately $89 million belonging to it through Capstone and that the amount represents around 80% of its monetary holdings. EQIBank has warned in court filings that losing access to the funds could place it at risk of liquidation.

The difference between the bank’s roughly $89 million claim and the government’s approximately $84.2 million forfeiture property should not be treated as an inconsistency that has already been resolved. EQIBank’s property claim and the government’s current forfeiture complaint use different figures and arise from separate filings.

EQIBank failed to recover funds through its first motion

EQIBank began its federal challenge on June 29 by seeking the return of property under Rule 41(g) in the U.S. District Court for the Eastern District of California. The government later filed a separate civil forfeiture complaint on July 15 involving the Capstone accounts and cryptocurrency.

During a July 16 hearing, District Judge Dale A. Drozd denied EQIBank’s return-of-property motion for lack of equitable jurisdiction after the government filed the civil forfeiture proceeding. The docket does not show that the judge decided whether EQIBank ultimately owns the seized funds or whether prosecutors are entitled to keep them.

The litigation remains active. On September 16, Judge Drozd ordered the original EQIBank matter and the government’s forfeiture action assigned to the same district and magistrate judges because the cases are related. The court expressly stated that the reassignment did not consolidate them.

A separate September 14 order requires the government to publish notice of the forfeiture action for 30 consecutive days on the federal forfeiture website. Anyone asserting an interest in the property must follow the claim procedure set out under Supplemental Rule G, after which responses to the complaint can proceed.

EQIBank maintains that it is an innocent owner of the money. In court papers quoted by The Information, the bank said “EQIBank is not a rogue bank” and said the government had not identified it as a target of the investigation. U.S. prosecutors have not adopted EQIBank’s characterization, and the forfeiture litigation has not reached a final judgment.

Tether’s latest audit provides separate reserve context

Tether completed its first full independent financial statement audit in August, covering the year ended December 31, 2025. KPMG U.S. issued an unqualified opinion on the audited financial statements, according to Tether’s August 13 announcement.

Tether said the 2025 audited statements showed reserves exceeding liabilities tied to issued tokens by $6.814 billion at year-end. KPMG examined transactions, asset ownership, valuations, counterparties, internal systems and supporting documentation, while physically inspecting Tether’s gold holdings.

As crypto.news reported in its coverage of Tether’s first full KPMG audit, the audit covered the company’s full 2025 financial statements and differed from quarterly reserve attestations that measure assets and liabilities at a specific date.

The KPMG opinion predates the June 2026 quarter-end figures and does not determine how much money Tether currently holds at EQIBank. Tether’s latest public statement on the bank gives only the percentage ceiling, while the federal proceeding concerns funds held through Capstone accounts at Wells Fargo and JPMorgan Chase.

The next procedural steps sit in the Eastern District of California forfeiture case. The September publication order gives parties claiming an interest in the seized property up to 60 days after the first day of publication to file claims, followed by a 21-day period to answer the government’s complaint or seek relief under Rule 12.

Crypto exchange Bitget suspects North Korean hackers may be behind a security breach that affected about $351.6 million in digital assets, citing preliminary evidence from an ongoing investigation.

Bitget CEO Gracy Chen said investigators identified internet protocol addresses linked to VPN services previously used by a North Korean hacking group. The pattern of the attack also resembled earlier operations attributed to the country, she said in a livestream on X earlier today.

Chen said the specific intrusion method used to enter Bitget’s systems remain under technical investigation.

Bitget detected unauthorized transfers from some wallets Thursday afternoon stateside, involving 19 transfers from parts of its hot and warm wallet infrastructure, while cold wallets remained secure, according to Chen.

Affected assets included ether, XRP, USDT, USDC, Avalanche and BNB across the Ethereum, XRP Ledger, Avalanche, BNB Smart Chain and Arbitrum networks. Earlier on-chain estimates put the outflows at about $183 million, but Bitget said those analyses had not captured activity across all affected blockchains.

The exchange’s security team found that the attacker breached a critical backend wallet system, used it to spoof transfer information and triggered Bitget’s authorization-signing process. Chen said that the breach had been contained, preventing further unauthorized outflows.

“Private key compromise has been ruled out,” she said.

Withdrawals remain suspended while technical teams repair and reinforce the affected systems, though deposits and trading continue normally.

While Chen declined to commit to a firm timetable, she said withdrawals could return within hours or days, but “shouldn’t take weeks,” in a broadcast on X a few hours after the attack.

The company maintains that customer balances are accurate and that the loss is fully covered by its User Protection Fund, which holds more than $464 million.

Bybit CEO Ben Zhou said his team was standing by to assist Bitget, which supported Bybit following its $1.5 billion hack in February 2025. Bybit is updating its LazarusBounty platform to help trace the stolen funds, Zhou added.

KelpDAO has sued LayerZero and co-founder Bryan Pellegrino in British Columbia over the April 18 exploit that drained 116,500 rsETH worth approximately $292 million.

KelpDAO said on September 24 that Evercrest Technologies Inc., the legal entity behind Kelp, filed the action to address what it describes as failures connected to LayerZero’s infrastructure. Kelp’s current terms identify Evercrest Technologies Inc. as the company providing the Kelp application.

The complaint, according to KelpDAO’s public account, alleges that LayerZero failed to disclose weaknesses and risks in its technology and failed to stop attackers from penetrating security infrastructure used by its verifier. No court has ruled on those allegations.

Pellegrino disputes the case. He called the claims “meritless” and said he would defend himself and LayerZero in Vancouver. Current reporting confirms the civil claim names both LayerZero and Pellegrino personally.

KelpDAO says LayerZero approved its bridge setup

KelpDAO’s case centers partly on the configuration of the rsETH bridge. The protocol says LayerZero had reviewed and approved its deployment and configuration in writing before the April exploit, contradicting LayerZero’s later argument that Kelp created a dangerous single-verifier setup.

LayerZero has given a different account. In its April incident statement, the company said Kelp used a 1-of-1 Decentralized Verifier Network, or DVN, leaving no separate verifier capable of rejecting a false cross-chain message. LayerZero said it had previously recommended verifier diversification and described the configuration as a single point of failure.

Kelp pushed back days after the attack. As crypto.news reported in its coverage of the dispute over LayerZero’s default configuration, Kelp said its bridge followed LayerZero’s documented defaults and relied on LayerZero-operated infrastructure. LayerZero maintained that Kelp had manually moved to the 1-of-1 configuration.

Pellegrino later said Kelp originally used multi-DVN or DeadDVN defaults before changing the rsETH deployment. Kelp has disputed LayerZero’s description of the discussions and now says its lawsuit will rely on written records showing LayerZero reviewed the setup.

LayerZero’s own infrastructure was compromised

The parties disagree over responsibility, but LayerZero’s final incident report confirms that attackers penetrated infrastructure operated by LayerZero Labs before the rsETH bridge released the funds.

LayerZero published its detailed report in May, saying the intrusion began on March 6 when an attacker socially engineered a LayerZero developer and obtained session credentials. The attacker then entered LayerZero’s RPC cloud environment and altered internal RPC nodes used by the LayerZero Labs DVN.

During the April 18 attack, the compromised nodes supplied false blockchain information while attackers launched a denial-of-service attack against external RPC providers. LayerZero’s DVN then signed a forged message because its available information indicated that the message was valid.

Kelp’s Ethereum bridge subsequently released 116,500 rsETH even though no corresponding burn had occurred on the source chain. Chainalysis described the event as an attack on off-chain verification infrastructure, not a smart contract vulnerability in Kelp’s rsETH token contract.

A second attempt sought another 40,000 rsETH, then worth roughly $95 million to $100 million, but Kelp had paused its contracts before the forged packet could execute. The pause occurred roughly 46 minutes after the successful drain.

As crypto.news reported in its LayerZero incident report coverage, LayerZero responded by ending support for 1-of-1 DVN configurations and moving affected applications toward multi-verifier setups. The company said its updated security model requires more independent verification paths.

Lawsuit follows months of competing blame

KelpDAO’s newly filed action turns a public technical dispute into a civil court case. Kelp says LayerZero and Pellegrino spent months placing responsibility on Kelp after infrastructure controlled by LayerZero was compromised.

LayerZero has maintained that the attacker could not have stolen the rsETH if Kelp had required multiple independent DVNs. Its May report said a hardened configuration requiring separate verifiers to agree would have stopped one compromised verifier from authorizing the forged message.

Security researchers have documented both parts of the failure. Blockaid found that LayerZero’s sole DVN authenticated the false cross-chain message and that the absence of a second verifier allowed it to reach Kelp’s Ethereum adapter.

Chainalysis reached a similar technical finding while focusing on the compromised infrastructure. Its investigation found attackers manipulated LayerZero-operated RPC nodes feeding the DVN and forced the verifier to rely on those nodes by disrupting external providers.

LayerZero and several researchers have attributed the attack to North Korea-linked TraderTraitor, associated with the Lazarus Group. LayerZero’s final report said Mandiant, CrowdStrike and independent researchers reached that attribution.

As crypto.news reported in its coverage of the Lazarus attribution, the finding came from LayerZero’s investigation and associated security work. The lawsuit concerns responsibility between Kelp and LayerZero for the conditions that allowed the exploit; the attribution does not resolve that civil dispute.

Kelp has moved rsETH away from LayerZero

Kelp began changing its bridge infrastructure while recovery work continued. In May, it announced a migration of rsETH cross-chain transfers from LayerZero’s OFT framework to Chainlink CCIP.

Crypto.news reported that Kelp moved rsETH toward Chainlink CCIP as the disagreement with LayerZero continued. Pellegrino disputed Kelp’s account of the original bridge configuration during that migration process.

By May 25, Kelp said it had transferred the final 20,373.72 rsETH tranche needed for its operational recovery plan. Minting, redemptions and rewards had resumed, while bridging services reopened after earlier asset transfers restored backing to the affected structure.

The recovery involved other DeFi platforms because the attacker had used stolen rsETH as collateral. Aave, Kelp and other participants organized a recovery process after the theft created losses in lending markets. As crypto.news previously reported, Kelp committed 2,000 ETH to the rsETH recovery effort as part of that process.

The civil case now moves into British Columbia’s court process. Under the province’s Supreme Court Civil Rules, a defendant generally has 21 days to respond after service in Canada, 35 days after service in the U.S., or 49 days when served elsewhere, unless the court orders another deadline. Pellegrino has publicly said he intends to contest the action in Vancouver.

Researchers at Alloc Init have proposed, in a September 24 paper, private Bitcoin transfers using zero-knowledge proofs without requiring a soft fork.

Alloc Init’s researchers Clara Shikhelman, Mikhail Komarov and Aleksei Moskvin published Shielded Bitcoin as a metaprotocol that uses Bitcoin to publish and order encrypted transaction data. Bitcoin nodes would not need to understand or enforce the privacy system’s rules.

Called Shielded Bitcoin, the proposed system borrows core ideas from Zcash, including encrypted notes, nullifiers and zero-knowledge proofs. It would conceal shielded senders, receivers, transferred amounts and links to earlier notes while leaving Bitcoin’s existing consensus rules unchanged.

The proposal remains research, not deployed Bitcoin software. Alloc Init has not announced a mainnet launch date, while a separate mechanism for moving BTC into and out of the shielded system remains under development. Founder Misha Komarov described the underlying technique as experimental during an interview published September 24.

Shielded Bitcoin moves privacy checks outside consensus

Under the proposed architecture, Bitcoin would function as what the researchers describe as a neutral publication and ordering layer. A shielded transaction would place encrypted notes, nullifiers and a zero-knowledge proof into data carried by an ordinary Bitcoin transaction.

Separate programs called indexers would read the data in Bitcoin’s established transaction order. An indexer would verify the zero-knowledge proof, check whether each nullifier had appeared before and update its view of the shielded system when the transaction passes those checks. Invalid shielded data could still enter the Bitcoin blockchain because Bitcoin itself would not enforce the metaprotocol. The indexer would simply reject it from Shielded Bitcoin’s state.

A sender would consume encrypted notes representing previously received value and create new notes for recipients. The proof would establish that the sender controls valid notes, has not created value from nothing and has balanced transaction inputs and outputs without exposing the underlying amounts or notes.

As crypto.news explained in its recent guide to zero-knowledge proofs, ZK systems can prove that a computation followed specified rules without revealing the private information used in that computation. Shielded Bitcoin applies that model to Bitcoin transfers, while its indexers handle verification outside Bitcoin consensus.

A dishonest indexer could provide stale information, omit transfers or delay wallet updates, the researchers said. Such an indexer would not gain control of a user’s spending key. Users could switch indexers or independently replay the shielded transaction history from Bitcoin.

How the Zcash-style design hides transaction links

Shielded Bitcoin closely follows the note model used by Zcash. Nullifiers identify when a note has been spent without publicly revealing which encrypted note produced the nullifier, allowing an indexer to reject double spending while keeping the transaction link hidden.

Komarov characterized the concept more simply in his September interview: “It’s basically Zcash.” He said users would place bitcoin into a private pool, receive encrypted notes and later spend, split or use those notes when withdrawing. Alloc Init intends to connect that system to Bitcoin through its PIPEs research.

Privacy would not make every part of the activity invisible. Public observers could still see when a Shielded Bitcoin transaction occurred, its timing, transaction fee, data size, number of notes consumed and created, and the Bitcoin transaction carrying the encrypted information. A recognizable Bitcoin wallet used to publish those transactions could reveal further information about the publisher.

The researchers provide separate read-only keys for viewing incoming or outgoing activity. Users could disclose selected transaction information to an accountant or counterparty without surrendering spending authority, though Alloc Init cautions that sharing a complete viewing key would reveal everything covered by that key.

In related coverage, crypto.news reported this week on expanding demand for privacy-focused crypto systems. The report cited ZecStats data showing 4.91 million ZEC in Zcash shielded pools, representing 29% of issued supply at the time.

Anonymity and quantum resistance remain contested

The proposal has drawn questions over how much privacy a new shielded pool could provide at launch. Developer Vadim Zavodil argued that Zcash already has years of shielded activity behind its anonymity set, while a new Bitcoin metaprotocol would begin with few participants.

“Privacy is a function of the crowd,” Zavodil wrote, arguing that an early Shielded Bitcoin user could have very few comparable transactions to blend into. His criticism focuses on practical anonymity from user behavior and pool size, not whether the cryptographic proof itself conceals its private inputs.

Alloc Init’s own explanation acknowledges the same general limitation. A large quantity of bitcoin entering a shielded system does not by itself create a strong anonymity set if only a few actors generate most notes or if individual wallets follow recognizable deposit, withdrawal or timing patterns.

Research on Zcash has documented similar behavioral problems. A peer-reviewed 2018 study found that transaction patterns could shrink the effective anonymity set even when the underlying shielded cryptography remained intact. The study examined an older Zcash implementation and predates several later upgrades.

Post-quantum researcher Pierre-Luc Dallaire-Demers raised a separate cryptographic concern. He described the construction as interesting but “not quantum resistant at all.” In a follow-up, he said he was examining what a fully post-quantum version could require if Bitcoin eventually adopts post-quantum signatures.

Komarov has given a more conditional account. His interview with Unchained said the shielded pool’s eventual route to quantum resistance would depend partly on Bitcoin’s own signature system. Alloc Init has not presented Shielded Bitcoin as a finished post-quantum implementation.

Zerocash co-author and StarkWare CEO Eli Ben-Sasson responded more favorably to the project’s direction, while noting that he had not yet reviewed the full paper. His support therefore represented an initial reaction, not a technical endorsement of the construction.

Shielded Bitcoin still needs its Bitcoin entry and exit system

A major unfinished component is the movement of actual BTC into and out of the shielded metaprotocol. Alloc Init’s September 24 explanation says the current paper specifies shielded transfers after value is inside the system, while a forthcoming paper will describe peg-ins and peg-outs using PIPEs.

PIPEs relies on witness encryption to make access to a Bitcoin signing key conditional on proof that specified rules were followed. Komarov explained to the Bitcoin Development Mailing List in February that PIPEs v2 could emulate certain covenant and zero-knowledge verification functions without requiring a Bitcoin soft fork.

The cryptographic machinery remains computationally heavy. Komarov’s February disclosure put a PIPEs v2 ciphertext at roughly 330 TB of storage, while stating that researchers knew a route that could eventually reduce the figure toward 100 GB. The smaller target had not been achieved in that publication.

Shielded transfers would consume more Bitcoin block space as well. Komarov told Unchained that an encrypted shielded payload would run around 700 virtual bytes, compared with roughly 100 to 200 virtual bytes for a typical Bitcoin transaction. He estimated the resulting miner fee could be approximately four times higher.

No launch date has been set. Komarov said the team is gathering technical feedback while continuing work on the experimental construction, including open attempts to find faults in the design and work with witness-encryption researcher Sanjam Garg.

The next publicly scheduled presentation is set for September 28, 2026. The Bitcoin Treasuries Conference agenda lists Alloc Init researcher Clara Shikhelman for a five-minute session titled “Shielded Bitcoin: Private Transfers on Bitcoin L1” in New York.

Alloc Init researchers have outlined a new approach they say could bring Zcash-style shielded transfers to Bitcoin without requiring a soft fork of the base protocol. The proposal, titled Shielded Bitcoin, aims to hide transaction amounts, senders, receivers, and linkages to previously spent funds by relying on encrypted “notes” and zero-knowledge proofs.

Published on Thursday by Clara Shikhelman, Mikhail Komarov, and Aleksei Moskvin, the design is intended to use Bitcoin as a kind of settlement and ordering layer—while separate software handles verification and state reconstruction for the privacy system. The result is a privacy overlay that, in theory, avoids asking miners or the wider network to enforce new rules.

Key takeaways

• Shielded Bitcoin proposes private transfers on top of Bitcoin without a soft fork by treating Bitcoin as an “ordering layer” rather than enforcing privacy rules at consensus.
• The system mirrors core Zcash components—encrypted notes, nullifiers to prevent double-spending, and zero-knowledge proofs for transaction validity.
• Privacy quality would depend on how quickly a meaningful anonymity set forms; critics argue early deposits may provide limited crowd-mixing.
• Commentators also raised open questions about cryptographic robustness and the practicality of the scheme.

How the proposal avoids a soft fork

In traditional privacy upgrades, hiding transaction details often requires changes that the network enforces. Shielded Bitcoin instead reframes the problem: rather than embedding privacy checks into Bitcoin’s mining and validation rules, the researchers propose using Bitcoin as “a neutral publication and ordering layer.”

Under this model, indexers—separate software components—would verify zero-knowledge proofs, confirm that the underlying funds have not been double-spent, and then reconstruct the evolving state of the shielded system. The encrypted notes and proofs would be published using Bitcoin transactions, but the privacy logic would be validated externally.

The paper’s key architectural point is that shielded validity does not have to be enforced by consensus for users to benefit from a private transfer—at least within the constraints of what other parties (wallets, relayers, and indexers) choose to accept and verify.

Why the Zcash-style design matters

The proposal explicitly draws from Zcash’s architecture. According to the paper, Shielded Bitcoin would use:

• Encrypted notes to conceal who owns funds and how much value is being moved.
• Public nullifiers that mark notes as spent, preventing double-spending without revealing note contents.
• Zero-knowledge proofs that demonstrate transaction validity while keeping sensitive details hidden.

However, Shielded Bitcoin differs from Zcash in one fundamental way: it is not presented as a separate shielded blockchain with its own consensus mechanism. Instead, it aims to plug a Zcash-like privacy system into Bitcoin’s existing infrastructure, using encrypted transaction artifacts and proof verification performed by external components.

For Bitcoin users and developers, the practical implication is clear: a privacy layer that can be deployed without consensus changes could lower the friction associated with privacy tooling. It also shifts the engineering burden toward wallets and verification infrastructure rather than requiring network-wide upgrades.

Early privacy may be weaker than Zcash’s anonymity set

Developer Vadim Zavodil was among the most pointed critics. Posting on X, Zavodil argued that a large share of the privacy “stack” already exists in Zcash and questioned how much privacy a newly launched shielded system could deliver immediately.

“Privacy is a function of the crowd. Zcash has a real shielded pool built over years of use. A brand new metaprotocol starts at zero, so your first private transfer hides in a crowd of one.”

In response, the Shielded Bitcoin researchers acknowledged the same concern. In a companion explanation published alongside the proposal on Notion, they said that large deposits do not automatically translate into a large anonymity set. They also warned that observers might still be able to infer relationships between transfers if a small number of actors create most notes or if wallets produce distinctive behavior.

This tension highlights a common theme for privacy systems: cryptographic soundness does not automatically guarantee anonymity. Shielded designs often depend on how users actually use them—how many participants join, how uniformly transactions behave, and whether patterns can be linked over time.

Questions extend beyond privacy: post-quantum concerns and intent

Another line of critique came from Pierre-Luc Dallaire-Demers, founder of post-quantum cryptography firm Pauli Group. He said the construction was “not quantum resistant at all,” framing the proposal as interesting while still leaving cryptographic assumptions in question.

Dallaire-Demers later indicated he was exploring what a fully post-quantum version could look like, contingent on Bitcoin eventually adopting a post-quantum signature scheme.

Supporters, meanwhile, emphasized the broader goal of bringing privacy to Bitcoin. Eli Ben-Sasson, a Zerocash co-author and CEO of StarkWare, responded more positively to the announcement. Although he said he had not yet read the full paper, Ben-Sasson argued that the intent behind Zerocash—preceding Zcash—was to bring privacy to Bitcoin. He said he would like to see the vision of privacy and scalability through zero-knowledge proofs materialize on Bitcoin’s base layer.

Taken together, these reactions underscore that Shielded Bitcoin is not being debated only on whether it “works” on paper. It’s also being evaluated on longer-term assumptions—particularly around anonymity set formation and the resilience of the cryptography to future threats.

As the proposal circulates among developers, investors and builders will likely watch for two practical follow-ups: whether any wallet or indexer implementation demonstrates credible usability and whether the system’s privacy properties improve as more independent users participate and diversify their behavior.

Ondo Finance has denied a report based on three anonymous sources that the tokenization company was offered to prospective buyers after founder Nathan Allman died on May 25, 2026.

CoinDesk reported that outreach to prospective buyers took place sometime after Allman’s death, citing three people familiar with the matter. Two sources placed the outreach after May 25, but the report said it could not establish who initiated the effort or what valuation may have been discussed.

Ondo rejected the account. A company spokesperson called reports of a possible sale “wholly untrue” and said nobody at the company had sought buyers or authorized another party to do so. Allman’s estate declined to comment to CoinDesk.

She described the breach as the digital version of slipping forged withdrawal slips through a bank’s own teller window. The vault keys never left the building. Someone got into the office that prepares the slips, created paperwork that looked official, and sent it through the same approval window the bank uses every day. To the system doing the approving, it looked like a normal payout.

The outflow, however, has been stopped, Chen confirmed.

“Loss containment is confirmed. No further unauthorized transfers are possible. The specific method of system intrusion remains under active investigation. A full technical report will follow once confirmed,” she said.

The breach

The breach surfaced when Bitget’s systems flagged unauthorized transfers from some exchange hot wallets at 18:31 UTC on Sept. 24. A hot wallet stays connected to the internet so funds can move quickly. For an exchange, it is a temporary liquidity hub, analogous to an online cash drawer that handles instant trades, deposits, and withdrawals.

Chen said the hack also reached the warm-wallet layer. That is a semi-connected buffer between the automated hot wallets and fully offline cold storage. It tops up the hot wallet when balances run low and pulls excess deposits off the internet so too much capital is not left exposed.