KelpDAO filed a lawsuit against LayerZero and its co-founder, blaming the universal bridge protocol for the largest exploit of this year, which drained $292 million and triggered one of the largest DeFi runs in crypto history, according to a post on X on Thursday.

“The exploit was a direct result of LayerZero’s failures, including a failure to disclose weaknesses and risks inherent in LayerZero’s own technology,” KelpDAO said.

KelpDAO, a decentralized liquid staking protocol on Ethereum, also accused LayerZero of failing to prevent infiltration of its security infrastructure, claiming that this allowed attackers to exploit the universal bridge’s alleged weaknesses.

“Rather than take responsibility, over the last few months, LayerZero and Mr. Pellegrino publicly blamed us for their failures,” KelpDAO said.

Pellegrino immediately responded that he would see them in a Canadian court.

“Evercrest (KelpDAO) filed a notice of civil claim today in BC (British Columbia, Canada) against myself and LZ (LayerZero),” Pellegrino said. “The claim continues to be meritless. I will meet them in Vancouver and defend myself accordingly.”

KelpDAO has filed a lawsuit against cross-chain protocol LayerZero following the roughly $292 million exploit of its rsETH bridge earlier this year, alleging that failures in LayerZero’s security infrastructure contributed to the attack.

KelpDAO said Friday that LayerZero failed to disclose risks in its technology or prevent attackers from compromising its infrastructure. It also alleged that LayerZero had reviewed and endorsed its deployment and configuration in writing before the exploit.

The lawsuit also names LayerZero co-founder and CEO Bryan Pellegrino.

“Our number one priority has always been and will remain the security of our users’ assets,” Kelp wrote. “But we also need to correct the record, and hold LayerZero and Mr. Pellegrino accountable for the harm they have caused us and the broader DeFi ecosystem.”

Pellegrino called the claim “meritless” and said he would defend the case in Vancouver. 

The lawsuit escalates a months-long dispute over whether the loss was caused by the compromise of LayerZero’s infrastructure, KelpDAO’s bridge configuration, or both.

Cointelegraph contacted LayerZero for further comment, but did not receive a response before publication.

Kelp and LayerZero have disputed responsibility since April

The April 18 attack resulted in the theft of 116,500 rsETH, worth about $292 million at the time, from Kelp’s LayerZero-powered bridge. 

In its final incident report, LayerZero said attackers compromised its internal nodes and caused its verifier to approve a forged cross-chain message. It argued that the loss was possible because Kelp’s bridge relied on a single LayerZero decentralized verifier network (DVN) as its only verification path.

Related: Recovery hopes fade as Kelp DAO hacker launders nearly all $220M in stolen funds

With no second independent verifier required, the bridge released the rsETH after receiving LayerZero’s verifier approved the forged message. LayerZero said it had recommended using multiple DVNs and subsequently stopped acting as the sole required verifier for applications.

Kelp has disputed LayerZero’s account of responsibility. In May, it said its DVN configuration had previously been discussed with LayerZero and “confirmed as secure,” while accusing LayerZero of failing to adequately warn it about the risks. Kelp subsequently announced plans to migrate the rsETH bridge to Chainlink’s Cross-Chain Interoperability Protocol.

Magazine: Winners and losers of the SEC’s new tokenized stocks rules

Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.

Bitcoin and Ethereum have remained near their recent highs as renewed talks between the United States and Iran have brought another proposal to reopen the Strait of Hormuz into focus, with lower oil prices potentially easing one of the pressures that has kept Treasury yields elevated.

Iranian Foreign Minister Abbas Araghchi said Thursday that Tehran had proposed a seven day plan to Washington under which hostilities would stop before the Strait of Hormuz reopened and comprehensive negotiations over Iran’s nuclear program began.

The proposal, delivered through intermediaries, calls for an end to hostilities including in Lebanon, the release of at least $12 billion in frozen Iranian assets, sanctions waivers for Iranian oil and the lifting of the U.S. naval blockade. Iran would reopen the strait at the end of the seventh day if those conditions were met.

Araghchi said Tehran was ready to start implementing the plan as soon as Washington agreed. An American official familiar with the discussions described talks through mediators as positive and constructive, but said Washington would not rush into an agreement.

Markets have already shown some sensitivity to the possibility of progress. WTI crude fell more than 2.5% to around $89 a barrel on Sept. 22 after Iran signaled that Hormuz could reopen within a week, while Brent dropped below $98. Bitcoin was trading close to $86,000 at the time.

Bitcoin has since settled near $84,000 after reaching $87,392 earlier in the week. Ethereum has held around the $2,600 area following its recent rejection near $2,800.

Bitcoin and Ethereum face high yields despite recent gains

Any agreement between Washington and Tehran would arrive while crypto traders are dealing with a difficult U.S. macro backdrop.

The Federal Reserve raised its benchmark rate by 25 basis points on Sept. 16 to a range of 3.75% to 4%, saying inflation remained elevated even as economic activity continued to expand at a solid pace.

Bond yields have continued climbing since the decision. The U.S. 10 year Treasury yield reached 5.11% on Sept. 24, up from 4.96% a day earlier, while the 30 year yield moved to 5.40%. The 10 year real yield climbed to 2.76%.

Rising oil prices have been part of that pressure. Brent moved above $100 earlier in September as fighting around Iran raised concerns over energy supplies, while the prospect of another Fed rate hike has kept borrowing costs in focus.

Crypto.news previously reported that Bitcoin held near $84,000 as the 10 year Treasury yield approached 5.2% during trading on Sept. 24. Oil prices were rising at the same time, while Fed officials kept another rate hike on the table.

Bitcoin has so far absorbed much of that pressure. U.S. spot Bitcoin ETFs recorded roughly $2.65 billion in net inflows over five sessions through Sept. 23, while wallets holding between 100 and 1,000 BTC accumulated 113,950 BTC from July 15 through Sept. 23.

The five day ETF inflow streak included $346.98 million on Sept. 23 after nearly $999 million on Sept. 21 and $714.7 million the following day.

Exchange balances have moved in the same direction. More than 13,800 BTC left Binance on a net basis in one day, the largest daily outflow from the exchange since 2023, while Bitcoin remained above $84,000.

Ethereum has followed a similar recovery, though its latest rally stalled below $2,800. ETH traded near $2,675 on Sept. 23 after reaching roughly $2,789, while U.S. spot Ethereum ETFs received $162.2 million on Sept. 22 and another $105 million the following session.

The token remained above its longer term four hour moving averages during the pullback, with Ethereum holding above its 50, 100 and 200 period averages even after losing the shorter 20 period average.

Why traders have heard Hormuz reopening plans before

The latest negotiations are not the first attempt this year to reopen the Strait of Hormuz.

Washington and Tehran reached a 14 point memorandum of understanding in June that declared an end to the war and provided for commercial vessels to resume using the waterway. Iran was expected to facilitate safe passage without charges for 60 days while the two countries worked toward a final agreement.

The arrangement soon began to break down.

Tehran interpreted the agreement as recognizing its authority to manage traffic through Hormuz, while Washington and Gulf states maintained that commercial vessels should have unrestricted passage without Iranian control.

By July, Iran had fired on vessels it said were using an unauthorized route and declared the strait closed again. Washington revoked a license allowing Iranian oil sales on July 7, while Tehran accused the United States of violating the memorandum. President Donald Trump subsequently described the initial ceasefire as over.

Attempts to restore traffic continued through the summer.

Iran said in August that it was preparing another set of conditions for reopening the strait after mediators approached Tehran. Officials discussed a shipping corridor with Oman, but Iran tied a full reopening to an end to the war, removal of sanctions, compensation and the lifting of what it described as a U.S. blockade.

Ceasefire arrangements announced in April and June had both been intended to restore maritime traffic but failed to hold, according to Reuters.

The latest proposal therefore resembles parts of the June arrangement but compresses the timetable. The earlier memorandum gave Washington and Tehran as long as 60 days to negotiate a final agreement. Araghchi’s new plan would reopen Hormuz after seven days and move directly into comprehensive nuclear negotiations.

What happens to Bitcoin and Ethereum if Hormuz reopens?

A lasting reopening could affect Bitcoin and Ethereum primarily through oil prices, inflation expectations and Treasury yields.

Before the war began in February, roughly one fifth of global oil and liquefied natural gas shipments passed through the Strait of Hormuz. Shipping through the waterway has remained heavily disrupted since then.

Restoring regular traffic would remove some of the supply uncertainty that has supported crude prices during the conflict. The initial market response to Iran’s Sept. 22 signal offered an early example, with WTI dropping more than 2.5% and Brent falling below $98.

Lower energy prices could, in turn, reduce one source of inflation pressure at a time when the Fed has returned to raising rates.

The relationship has already worked against crypto during periods of renewed fighting. On Sept. 2, Ethereum fell below $2,400 as fresh U.S. Iran strikes pushed Brent toward $95 and the 10 year Treasury yield above 4.8%. ETH reached an intraday low of $2,356 during the session.

Conditions became more restrictive later in the month as oil moved above $100 and Treasury yields crossed 5%. Ethereum traded near $2,475 on Sept. 15 before recovering after the Fed decision and the subsequent crypto rally.

A sustained decline in oil following a Hormuz reopening would not guarantee lower interest rates. The Fed’s Sept. 16 statement said inflation remained elevated, while domestic spending, productivity and capital investment remained firm.

It could, however, remove part of the energy pressure that has complicated the inflation outlook. A decline in inflation expectations and Treasury yields would reduce the return available on government debt, changing one of the macro conditions that has recently worked against Bitcoin and Ethereum.

Bitcoin’s first major test would remain the $86,700 to $87,400 area, where the latest rally stalled. The previous range high near $82,000 has become an important level below the market, while the $80,000 area sits beneath it as the former upper boundary of Bitcoin’s earlier trading range.

A move back through $87,400 alongside falling oil and Treasury yields would put the January yearly open near $87,722 back into focus. Continued ETF demand would provide another source of spot buying after the recent five session inflow run.

Ethereum would first need to recover $2,700 before challenging the recent $2,789 high and resistance around $2,800. Its latest pullback left support around $2,648, followed by liquidity near $2,630 and the larger $2,532 to $2,550 area.

Another failed deal could keep oil and yields in focus

The opposite setup remains possible given the fate of previous agreements.

Iran’s seven day proposal requires Washington to lift its naval blockade, provide sanctions relief and release frozen Iranian assets before Hormuz is reopened. The United States has acknowledged constructive discussions through mediators but has not accepted those conditions.

A renewed breakdown in negotiations could leave shipping restrictions in place and restore some of the geopolitical premium recently removed from crude.

Bitcoin has already shown that higher yields can interrupt its rallies even when underlying spot demand remains firm. After reaching $87,392 on Sept. 21, BTC retreated toward $84,000 as Treasury yields moved higher, despite consecutive ETF inflows and continued accumulation among larger wallets.

Ethereum faces a similar macro constraint after failing to hold its move toward $2,800. The nearest downside levels remain around $2,648 and $2,630, while a deeper decline would bring the $2,532 to $2,550 area back into view.

Araghchi said Iran was prepared to begin implementing the seven day plan once Washington agreed and suggested reaching an agreement before the U.S. midterm elections would be preferable. Mediated communication between the two sides continued after his meeting with U.S. envoy Steve Witkoff and Jared Kushner in New York, while Iranian officials said further meetings could take place in the coming days.

Ethereum has held near $2,667 after pulling back from the $2,800 region, while ETF inflows and exchange withdrawals continue as traders assess whether the recent breakout can survive.

CoinGecko data show ETH closed around $2,687 on September 24 after reaching $2,775 on September 21. At the time of writing, Ethereum traded at $2,666.63, down 0.78% over 24 hours but up 7.90% over seven days, with a market capitalization near $326.3 billion.

The pullback followed a steep recovery from below $2,400 earlier in September. ETH approached $2,800 before sellers stopped the advance, bringing the former breakout area around 2,530–2,540 back into focus.

Why is Ethereum price struggling below $2,800?

Ethereum’s first problem sits around the recent high. The $2,530–$2,540 region previously acted as resistance and could now serve as support after the breakout. Analyst Wealthmanager placed a potential retest near $2,539, while the larger upside projection near $3,391 remains conditional on ETH holding support and clearing several resistance levels.

The supplied daily chart gives buyers some technical support. ETH remains above the 20-day Bollinger Band midpoint at $2,557.52. The upper band stands near $2,781.85, close to the region where the latest rally stalled, while the lower band sits around $2,333.18.

Bull Bear Power remains positive at approximately +124.67. Buyers therefore retain an advantage on that indicator, although the latest positive bars have contracted from their recent highs. Momentum has cooled as ETH moved away from the upper Bollinger Band.

Advertisement

As crypto.news reported in its Ethereum $2,800 rejection analysis, ETH remained above its longer 4-hour moving averages even after falling below $2,700. The 100-period moving average stood near $2,540.49, almost directly inside the breakout support zone now being watched.

That analysis placed the 4-hour 200-period moving average near $2,499.93. A deeper decline through the 2,530–2,540 region would therefore bring the $2,500 area into view before the much lower Bollinger support around $2,333.

Can ETF inflows keep the Ethereum breakout intact?

U.S. spot Ethereum ETFs have continued attracting money even as ETH retreated from its recent high. SoSoValue data showed $66.1 million in net inflows on September 24, extending the streak to five consecutive trading sessions.

BlackRock’s ETHA led the session with $26.8 million, followed by Fidelity’s FETH with $21.5 million. Grayscale’s Ethereum Mini Trust drew another $17.8 million. No U.S. spot Ether ETF recorded a net outflow during the session.

Across the five-session run, the funds accumulated $746.5 million. The sequence included $270 million on September 21, $162.2 million on September 22, $104.5 million on September 23 and $66.1 million the following session.

Advertisement

The declining daily inflow totals show that ETF demand has remained positive while slowing from the strongest session. Fund flows measure subscriptions into regulated products and do not establish whether ETH will hold any particular technical level.

Ethereum’s rejection near $2,800 occurred while institutional ETF demand stayed positive. As crypto.news previously reported in its analysis of Ethereum ETF inflows during the $2,800 rejection, the September 21 and 22 sessions alone drew $432.2 million before ETH fell below $2,700.

Exchange flows show ETH leaving as stablecoins enter Binance

CryptoQuant contributor CryptoOnchain reported another pattern beneath the pullback. Ethereum exchange netflow moved from +138,174 ETH on September 18 to -138,247 ETH on September 23, meaning the observed flow changed from net deposits to net withdrawals as the price retreated from $2,775.35.

At the same time, CryptoOnchain reported that Binance stablecoin netflow averaged approximately $107.98 million per day during the week ending September 23, up 552% week over week. The analyst described one possible reading as capital positioning for re-entry, though that interpretation remains “unverified.”

A separate CryptoQuant post from the same analyst reported an average daily Binance USDT-on-Ethereum netflow of $80.8 million in the week ending September 21, the highest reading in its six-month comparison window. Binance’s total stablecoin reserve stood at $43.59 billion in that dataset.

Advertisement

CryptoOnchain’s September 23 dataset found that the Coinbase Premium Index remained negative, ranging from -0.01 to -0.09 during the observed period. Under that measure, U.S. Coinbase spot activity did not lead the move toward the September 21 high.

The staking rate moved in the opposite direction, rising from 35.30% to 35.71% during the same period, according to the analyst. Staking changes occur more slowly than daily price action, so the rise does not establish a direct cause for ETH’s latest rebound.

Will Ethereum reach $3,000 before a deeper correction?

The immediate upside test remains 2,781–2,800. The upper Bollinger Band sits around $2,781.85, while recent spot trading failed to sustain a move through the same region. Regaining it would leave $3,000 as the next large psychological level identified across several analyst setups.

RektProof’s scenario projects that ETH “could” approach $3,000 before rotating lower toward equal lows around $2,300. The analyst places heavier resistance between $3,000 and $3,200. Such a path remains a forecast, not a confirmed price target.

Advertisement

Wealthmanager’s chart uses a more aggressive conditional target near $3,391 if ETH successfully holds $2,540 and clears $2,800 and $3,000. IncomeSharks has separately mapped a deeper liquidity sweep toward 2,100–2,200 before a potential recovery toward 3,400–3,500. Neither path has been confirmed by current price action.

$ETH – Original squiggles still spot on. This is where I want to call it good and delete the rest but will leave them. Hopefully we don’t have a lower fakeout still on the table. pic.twitter.com/iY6JRnx27a

— IncomeSharks (@IncomeSharks) September 22, 2026

Leverage creates another risk around the support zone. Analyst Celal Kucuker warned that heavy long positioning “could” produce a liquidation-driven decline of approximately 20% if support fails and forced selling accelerates. The scenario would weaken if buyers defend support and ETH recovers.

More immediate liquidation data place the first pressure points much closer to the market. Crypto.news reported liquidation bands around $2,650 and $2,630 after ETH’s September 23 reversal, with another concentration around $2,700.

Advertisement

For the current chart, $2,557.52 remains the Bollinger midpoint, while the 2,530–2,540 region combines former breakout resistance with the 4-hour 100-period moving average. A recovery would first face 2,781–2,800 before the 3,000–3,200 resistance range identified by the analyst charts.

Disclosure: This article does not represent investment advice. The content and materials featured on this page are for educational purposes only.

Advertisement

Samourai Wallet co-founder Keonne Rodriguez says inmates at FCI McKean have been told that he and about 70 other participants will be transferred to different facilities after a drug treatment program was deactivated. Rodriguez made the claim on X, adding that he had entered the program because completing it could reduce his sentence by up to a year.

The situation comes as Rodriguez—who is serving a five-year term for his role in an unlicensed money-transmitting business—continues to navigate prison transfers while his case remains entangled with broader U.S. policy debates over whether developers who do not control users’ funds can be treated as financial intermediaries.

Key takeaways

• Rodriguez says FCI McKean deactivated a drug treatment program tied to sentence-reduction eligibility for him and roughly 70 other participants.
• He reported that a prior transfer from FPC Morgantown to McKean proved far longer and harsher than expected, with travel that he said he was not allowed to do himself.
• The federal government states Rodriguez and Samourai co-founder William Lonergan Hill transmitted more than $237 million in criminal proceeds through the service.
• In Congress, the CLARITY Act framework aimed at protecting non-controlling crypto developers from certain money-transmission obligations has stalled after a Senate procedural vote failed.

FCI McKean program ended; another transfer expected

Rodriguez said on X that the warden at FCI McKean informed program participants that he and 70 others would be moved to facilities where treatment is still available. He framed the transfer as a setback to his attempt to continue the drug treatment program.

Rodriguez entered the program because completing it could reduce his sentence by up to a year, according to his account. With the program deactivated at McKean, the practical next question for investors and crypto builders is what this means for Rodriguez’s ability to stay on track for any sentence-reduction pathway—especially since transfers can disrupt schedules, eligibility, and continuity of care.

Rodriguez describes a harsher-than-expected transfer from Morgantown

In a letter published by The Rage, Rodriguez characterized his initial move from FPC Morgantown to McKean as the “absolute worst 30 days” of his life. He said his request to make the approximately four-hour trip himself was denied, and he described the process as far more drawn out.

According to Rodriguez, inmates leaving Morgantown were placed in ankle shackles and handcuffs attached to waist chains before being transported by bus to an airport and flown to the Federal Transfer Center in Oklahoma City. He said that once at the transfer center, he was held with prisoners from different security classifications and spent most of his time locked in a cell.

Rodriguez also wrote about the conditions at the Federal Transfer Center, including that he wondered whether the “all the circles of hell” were contained within the facility. He later said he was assigned a cell with an inmate serving a murder sentence and that he received only part of a foam mattress, leaving part of his body to rest on a metal bunk overnight.

Conviction and sentence: what prosecutors said Samourai did

Rodriguez is serving a five-year sentence after pleading guilty to conspiring to operate an unlicensed money-transmitting business. Cointelegraph previously reported on the case’s broader developments surrounding a petition and related legal efforts, including coverage that ties Rodriguez’s sentence to Samourai’s operation.

Separately, the U.S. Department of Justice said in a sentencing announcement that Rodriguez and co-founder William Lonergan Hill transmitted more than $237 million in criminal proceeds through the service. The government’s framing focused on the transmission of criminal funds rather than on any claim that users retained full control or that developers were outside the flow of money.

For readers following crypto policy, that legal characterization helps explain why the debate over “developer protections” is central to the sector’s risk outlook: it highlights the potential gap between how software is built (and who controls assets) and how prosecutors may describe the service’s economic function.

CLARITY Act pause leaves developer protections in limbo

Rodriguez’s case has unfolded alongside congressional efforts intended to reduce compliance risk for crypto developers who do not control users’ assets. Those efforts are reflected in the CLARITY Act framework, which has sought to clarify that non-controlling developers should not necessarily be treated as financial intermediaries subject to money-transmission requirements under the Bank Secrecy Act.

According to Cointelegraph’s coverage, the latest Senate CLARITY Act draft retained Blockchain Regulatory Certainty Act provisions designed to protect non-controlling developers from certain money-transmission obligations. However, the Senate failed to advance the CLARITY Act on Sept. 15 after a procedural vote fell short of the 60 votes needed to move the legislation forward.

That legislative stall matters to builders and businesses because it increases uncertainty around how federal agencies and courts could interpret developer involvement going forward—especially in cases where software tools, even without direct user asset control, are alleged to have facilitated illicit financial activity.

What to watch next

Rodriguez’s reported transfer after the deactivation of drug treatment at FCI McKean will likely be the immediate development to follow, because sentence-reduction eligibility can hinge on program continuity. At the same time, the broader policy question—whether the Senate will revive and pass the CLARITY Act to better define developer obligations—remains unresolved, leaving crypto firms to plan under continued legal ambiguity.

Samourai Wallet co-founder Keonne Rodriguez faces another prison transfer after the drug treatment program at FCI McKean was deactivated, he said Wednesday.

Rodriguez said on X that McKean’s warden told program participants that Rodriguez and 70 others would be moved to facilities where treatment remains available. He entered the program because completing it could reduce his sentence by up to a year.

In a letter published by The Rage, Rodriguez called his earlier journey from FPC Morgantown to McKean the “absolute worst 30 days” of his life. He said his request to make the roughly four-hour trip himself was denied.

Rodriguez is serving a five-year sentence after pleading guilty to conspiring to operate an unlicensed money-transmitting business. The Justice Department said he and Samourai co-founder William Lonergan Hill transmitted more than $237 million in criminal proceeds through the service.

A four-hour drive became 30 days in transit

Rodriguez said inmates leaving Morgantown were placed in ankle shackles and handcuffs attached to waist chains before being taken by bus to an airport and flown to the Federal Transfer Center in Oklahoma City.

Related: Samourai Wallet co-founder spends Christmas Eve recounting first day in prison

At the facility, Rodriguez said he was held with prisoners from different security classifications and spent most of his time locked in a cell. At one point, he wrote that he wondered whether “all the circles of hell” were contained within the federal transfer facility.

Rodriguez said he was eventually assigned a cell with an inmate serving a murder sentence and was given only part of a foam mattress, leaving part of his body resting on a metal bunk overnight. 

Developer protections remain uncertain after CLARITY setback

The case unfolded alongside congressional efforts to protect developers who do not control users’ assets from being treated as financial intermediaries.

The latest Senate CLARITY Act draft retained Blockchain Regulatory Certainty Act provisions protecting non-controlling developers from certain money-transmission requirements under the Bank Secrecy Act.

The Senate failed to advance the CLARITY Act on Sept. 15 after a procedural vote fell short of the 60 votes needed to move the legislation forward.

Magazine: Winners and losers of the SEC’s new tokenized stocks rules

Cointelegraph is committed to independent, transparent journalism. This news article is produced in accordance with Cointelegraph’s Editorial Policy and aims to provide accurate and timely information. Readers are encouraged to verify information independently.

Magic Eden has faced reports of a possible contract exploit after unusual transactions showed thousands of NFTs being sold for 0 ETH, although one account involved in the activity has claimed the transfers are part of a whitehat operation.

NFT trader Cirrus first flagged the activity on Sept. 25, saying NFTs were showing sales originating from Magic Eden and that the marketplace’s contract may have been exploited.

No idea whats going on here but I just watched this wallet drain 3832 NFTs from 100s of different wallets

May be a good idea to revoke all NFT permissions if you have any valuables in your wallet

Advertisement

Seems to be funded from a wallet possibly linked to @0xQuit so maybe a whitehat? pic.twitter.com/semJYsjEXX

— Cirrus (@CirrusNFT) September 25, 2026

Cirrus later warned users who had previously interacted with Magic Eden to remove their approvals after observing someone selling thousands of NFTs to themselves for 0 ETH. The trader noted at the time that the activity could potentially be linked to a whitehat.

Magic Eden had not released an official statement confirming an exploit at the time of writing, leaving the nature and scale of the incident unclear.

Possible whitehat says NFTs are safe

Shortly after the warning, pseudonymous X user Quit claimed the activity was a whitehat operation.

hey ya this is a whitehat and everything in 0x71cF3f5724bD2B72Ef6464992aCd26216DE7fe33 is safe and will be returned once they are no longer at risk

— Quit (@0xQuit) September 25, 2026

Quit said assets held at 0x71cf3f5724bD2B72Ef6464992aCd26216DE7fe33 were safe and would be returned once they were no longer considered at risk.

No confirmation from Magic Eden has established that the address belongs to an authorized whitehat or that the transactions were carried out as part of a coordinated recovery effort.

Details about the vulnerability that may have allowed the transactions, how many wallets were affected and the total value of NFTs moved have not yet been disclosed.

Magic Eden had ended EVM marketplace support

The unusual Ethereum NFT activity comes months after Magic Eden changed its marketplace operations.

Crypto.news previously reported that Magic Eden ended support for its Bitcoin and EVM based NFT marketplaces earlier this year while retaining its Solana marketplace.

Magic Eden’s own support documentation states that EVM marketplace support ended on March 9. The company said listings, bids and offers on its EVM marketplace were offchain and would stop being visible or actionable after the shutdown.

The platform continues to support its Solana marketplace, while its current products include Packs, which can contain NFTs from Ethereum collections. Magic Eden says NFTs revealed through Packs can be traded on the marketplace.

Magic Eden has yet to say whether the activity reported on Sept. 25 affected any of those services or involved contracts associated with its discontinued EVM marketplace.

(This is a developing story.)