Stablecoin issuer Tether said it has very little exposure to a lender seized by U.S. authorities on Thursday.

Tether said assets it holds at EQIBank represent less than 0.034% of its total assets, after the Dominica-licensed lender was caught up in a U.S. asset seizure that it said could force it into liquidation, according to reports by the Financial Times and The Information.

“Tether had no knowledge of the conduct by Capstone alleged by the Department of Justice,” a Tether spokesperson told CoinDesk via email. The company said assets held at EQIBank were limited to “less than 0.034% of the assets of the group,” but did not disclose the exact dollar amount.

Based on Tether’s June report of $187.75 billion in group assets, the percentage the spokesperson said was at risk would put the EQIBank exposure at roughly $64 million.

EQIBank used Capstone, a U.S. payment processor, to hold funds and move customer money through accounts at Wells Fargo and JPMorgan Chase, according to court filings. U.S. prosecutors seized money from those Capstone accounts and filed a civil forfeiture case, alleging that Capstone misrepresented its business to banks.

Bitcoin’s September 25 quarterly options expiry has put an enormous open-interest figure beside a much smaller and less visible question: which contracts produced payments? The exchange rules tell us what a winning holder receives. They do not turn a pre-expiry headline into a verified account of money transferred at settlement.

Bitcoin options worth billions of dollars have reached their quarterly expiry, but the advertised amount has not been paid from one side of the market to the other.

Deribit’s published expiry schedule puts the September quarterly contracts on the final Friday of the month at 08:00 UTC. Its delivery-price policy uses an index time-weighted average between 07:30 and 08:00 UTC. That is the price reference for automatic exercise and settlement of qualifying contracts. A pre-expiry estimate describes positions still open at an earlier observation time. It cannot be read as a receipt for the 08:00 settlement.

A September preview of the combined expiry cited approximately $18.1 billion across Bitcoin and Ether as of September 23, with Bitcoin accounting for about $16.1 billion in the snapshot it reported. An earlier $16.6 billion combined estimate appeared on September 15. Neither figure is a timestamped count of contracts that remained open at the cutoff, much less the cash or coins exchanged by winners and losers. The amount changes as positions are opened, closed or rolled, and as the underlying Bitcoin price changes the dollar translation of BTC denominated contracts.

There are three separate ledgers behind the headline. Open interest measures the outstanding contract position before expiry. Intrinsic settlement measures the value of options that finish in the money at the prescribed price. Net trading profit adds the premium paid or received and the results of any hedge put on before settlement. They are different numbers, potentially recorded in different assets. Collapsing them into one figure makes a market event sound more like a mass transfer than the contract terms support.

The big number measures outstanding positions

An option gives its buyer a right linked to a specified strike price, while its seller has the corresponding obligation. A call benefits from a settlement price above its strike. A put benefits from a settlement price below it. Open interest counts outstanding positions, ordinarily one long and one short for each open contract. Counting those two sides as separate piles of wealth would double-count the economic exposure. Counting every dollar of notional as a payout makes a different mistake: an option can expire without value, or finish only a small distance beyond its strike.

The reported $16.1 billion Bitcoin component was a pre-expiry estimate of outstanding positions, not the amount of premium paid when those positions were first traded. Option premiums can be a fraction of the notional exposure and vary with strike, maturity and implied volatility. Nor is the estimate the maximum loss of every buyer. A buyer generally risks the premium paid, while a short option can have a very different risk profile, subject to margin and any offsetting trades.

The exchange and the publication also define the scope of the estimate. A figure drawn from Deribit data does not automatically include every venue’s Bitcoin options, over-the-counter positions or listed futures used as hedges. Even within one venue, a dollar presentation can translate BTC contract sizes using an underlying price that differs from the eventual delivery price. To audit a headline, a reader needs its observation timestamp, currency, contract universe and calculation method.

The September 23 snapshot preceded expiry by almost two days. Some positions could have been closed through a trade, reducing open interest; others could have been opened or shifted into later maturities. A trader rolling a September call into October does not receive the September notional as cash. The exchange offsets the old position in a transaction and the trader opens another position at a different premium. Exchange volume during that process is real trading activity, but it is distinct from the final exercise amount.

Deribit’s contract specifications also distinguish inverse, BTC settled options from linear options whose results are settled through USDC products. A dollar sum across instruments may be a convenient scale measure, yet it does not identify a single pot of dollars ready to move at 08:00. The legal contract and its settlement currency determine the ledger entry. The quoted notional alone cannot.

The contrast has appeared in earlier coverage. After an August expiry of roughly $9.6 billion of options, the market could still trade on funding, spot flows and macroeconomic news. The fact that a large maturity arrives on a calendar does not isolate its price impact. It does, however, eliminate the expiring option positions and may change how dealers hedge any positions that survive in other instruments.

The 08:00 price sets exercise, not trading volume

Deribit’s delivery-price documentation specifies an index time-weighted average during the 30 minutes ending at 08:00 UTC for the relevant expiry. This matters because a single last trade at 08:00 is not the settlement price. A headline saying Bitcoin briefly touched a strike cannot show whether a call or put settled in the money. The exchange’s published delivery price, for the correct underlying and date, is the relevant reference.

For a conventional European-style option, exercise at expiry depends on the relationship between that delivery price and the strike. A call struck at $80,000 is worth $5,000 per BTC of underlying at a hypothetical $85,000 delivery price before premiums and contract-specific currency conversion. A call struck at $90,000 has no intrinsic value at the same price. A put struck at $90,000 has $5,000 per BTC of intrinsic value. Those values do not tell us how much any holder made: the holder could have paid $6,000 for the first call and lost $1,000 after the exercise value.

That $85,000 is an illustrative price, not a claim about September 25’s actual delivery price. It lets us separate the unit of notional from the unit of payment. Consider a holder of one BTC equivalent of the $80,000 call. The holder’s $80,000 strike exposure is not transferred at expiry. On these assumptions, the gross intrinsic value is $5,000. For a corresponding inverse BTC cash-settled calculation, a $5,000 USD value converted at $85,000 per BTC is approximately 0.058824 BTC. The exact exchange debit and credit must follow the instrument’s own payoff specification, including contract size and rounding.

Change the hypothetical delivery price to $80,100, and the same call has just $100 per BTC of intrinsic value. Leave it at $79,900, and the call has none. The advertised notional attached to the open position could look broadly similar in all three cases just before settlement, while the actual exercise value changes dramatically. Near-the-money concentration is therefore more informative for settlement than a single aggregate notional.

Deribit’s inverse options specifications describe automatic exercise of in-the-money options and cash settlement in BTC. Cash settlement means an account is credited or debited under the contract; it does not require delivery of physical Bitcoin in exchange for a strike payment, nor a purchase of one BTC in the spot market for every expiring call. Its delivery procedure pauses trading in expiring instruments around the event and updates balances. The clearing system nets obligations by account and contract. Public open interest, which consists of outstanding longs and shorts, does not reveal that account-level netting.

Some traders may have exchanged premiums minutes or weeks earlier. A customer can buy a call from a market maker, and the market maker can hedge by buying spot Bitcoin or futures. When the option expires, that hedge may be reduced, maintained for another exposure or transferred to a new maturity. A spot purchase before expiry and a sale after expiry are actual market trades, but neither should be labeled the option settlement cash flow. An observed burst of spot volume requires a separate attribution to identify whose hedges changed.

Two contract designs can pay in different assets

The BTC inverse option and a USDC linear option may both appear in a dashboard of Bitcoin options exposure. Their payoff plumbing differs. Deribit’s inverse option uses BTC as the settlement currency. Its value expressed in dollars at the delivery price is translated into a BTC account change. A participant receiving BTC can choose to sell it later, but the settlement itself is an exchange-account credit in the contract currency, not automatic evidence of a sale into dollars.

Deribit’s current linear-options documentation says the USDC product exercises into a future and that the resulting position is cash settled in USDC. The exchange introduced this two-step arrangement in April 2026. At expiry, therefore, describing every Bitcoin option as simply paying BTC would be incorrect. The exercise may create an offsetting futures position before the USDC settlement step. The relevant futures specifications say profit and loss is transferred in USDC. A reporter has to inspect the instrument code before calling the payment BTC, USDC or a spot-market purchase.

The term cash settled can confuse readers because it does not necessarily mean a bank-wire transfer in fiat currency. On a crypto derivatives venue it refers to a ledger cash flow in the contract’s specified unit, potentially BTC or a stablecoin account balance. These credits and debits are real economic transfers between counterparties through the clearing venue. Their total gross value is not published merely by reporting options open interest.

The conversion creates a subtle accounting issue. If a BTC-settled inverse option has a fixed USD intrinsic value in a hypothetical payoff, the number of BTC credited depends on the delivery price used for conversion. Summing BTC credits across strikes and translating the result at a different spot price later would give another dollar figure. A claim of an exact amount “changing hands” must identify its unit and valuation time. The same headline can otherwise conflate the option’s reference exposure with coins delivered, dollar-valued settlement and exchange volume.

This distinction matters to risk as well as to journalism. A trader receiving BTC from a winning inverse option can have more BTC exposure after settlement unless another position offsets it. A USDC linear payout adds a different balance and may leave no equivalent BTC holding. If the goal is to infer buying pressure from expiry, one would need to observe how recipients traded those balances, what sellers did to cover obligations and whether market makers unwound hedges. The settlement rules alone do not establish a directional spot flow.

Max pain is a model, not a clearing result

Expiry coverage often quotes a “max pain” strike, the price at which the aggregate intrinsic value of open call and put positions would be minimized under a specified snapshot and simplified assumptions. The number can be recalculated when positions change. It does not dictate the actual delivery price, and it is not an amount transferred. The method also assumes open-interest holders have similar interests, while real accounts can combine options at several strikes, futures, spot positions and exposures on other venues.

An options seller might welcome a given strike finishing out of the money in isolation. The same trader may have bought an offsetting option, sold futures or hedged spot inventory, changing the net economic result. An observed concentration of calls at one strike does not tell us whether the holders are retail buyers, institutions hedging a different position or market makers long an option against a short elsewhere. The published distribution does not identify the beneficial owners or their net books.

It’s that time of year again in the United States. The days start to draw in, the leaves start to fall, and the tax man comes knocking for your 2025 return.

This year, thanks to the Inland Revenue Service’s new rules, the agency now knows more about Americans’ crypto trades than ever before, with brokers required to report gross proceeds from certain digital asset sales.

But unfortunately for some taxpayers, getting a form from an exchange hasn’t made filing their returns any easier.

A survey of 1,000 US crypto investors conducted in August by Awaken Tax found that 21% of respondents who had filed, or planned to file a tax extension, said they were still waiting for information they needed from an exchange or crypto platform.

A further one in five said their 1099-DA, the tax form brokers use to report certain digital asset sales, was either incomplete or they weren’t sure whether it accurately reflected their transactions.

The numbers come as taxpayers attempt to navigate the first filing season under the new reporting rules, with those who filed for an extension having until Oct. 15 to submit.

For 2025, brokers were generally required to report the proceeds (how much an asset was sold for), but not the cost basis (how much the taxpayer originally paid for it).

That requires taxpayers to calculate their gains and losses themselves, which isn’t much fun even for infrequent traders, but is a time consuming quagmire for active ones.

Chris Herbst, managing director of CountDeFi tax reporting, tells Magazine, “For an active trader, that number can be many times their real gain, because each sale is counted at full value with no cost against it.”

And that gets to the heart of the problem: the IRS can see the sale, but the taxpayer still has to work out what they actually made.

What the new 1099-DA actually tells the IRS

For a simple transaction, the calculation is straightforward. If you bought Bitcoin for $9,000 and sold it for $10,000, the gain is $1,000.

Understanding your Form 1099-DA. Source: IRS.gov

But a 2025 1099-DA could show the $10,000 in proceeds without reporting the $9,000 basis needed to calculate that gain. So if you don’t know how much you spent on a particular crypto asset, working out the math can become a Byzantine exercise.

Related: US House tax committee advances crypto tax overhaul in 38–5 vote

And it means taxpayers need their own records to fill in the missing pieces, including information that may stretch across multiple exchanges, wallets, trades and years.

“The gap is real,” says Herbst, “but it is a record-keeping gap on the taxpayer side as much as a reporting gap on the exchange side.”

When the forms don’t match

Tax professionals say they are already seeing problems when taxpayers try to reconcile the new forms with their transaction histories.

Sharon Yip, founder of Crypto Tax Advisors, says her firm has found discrepancies between the 1099-DAs received by clients and the crypto tax reports it prepared for them.

Some forms did not include all the trades clients made during 2025, Yip says, while exchanges also used different formats for their customer statements. Some exchanges reported cost basis on certain trades but not others, she says, even though reporting basis was not mandatory for 2025:

“It’s very confusing for recipients to understand how to reconcile their 1099-DAs when compared to the crypto tax report they should use to file their tax return.”

She also gives an example involving stablecoins, saying one of her firm’s clients had more than $300,000 in stablecoin trades on an exchange in 2025, but the exchange’s 1099-DA showed less than $100,000 in total stablecoin proceeds.

And the issues can start before taxpayers even get to calculating their gains. Andrew Duca, founder of Awaken Tax, says the firm saw customers receiving 1099-DAs relatively late in the filing season.

“Because this regulation is new, a lot of exchanges are still trying to figure it out,” he says, pointing to exchanges like Kraken that “didn’t send any forms to users until two weeks before the tax deadline of April 15.”

Duca says Kraken only sent 1099-DA forms two weeks before the deadline. Source: Andrew Duca

Duca also cites the example of a Kraken 1099-DA from around the same period that shows no reported transaction information.

Kraken did not respond to Magazine’s request for comment.

The information taxpayers still need

But here’s the thing: the new forms were never intended to replace taxpayers’ own records. The IRS says taxpayers must report digital asset income and gains or losses whether they receive a 1099-DA or not.

Related: Chainalysis estimates $457B in taxable crypto activity, says CARF misses most

Where the basis is not reported, taxpayers should use their own records to complete their tax return, but that gets complicated quickly when crypto assets move frequently between platforms.

So, you might buy Bitcoin on one exchange, transfer it to a private wallet, move it to another exchange and sell it there — and the second exchange doesn’t have the information showing what you originally paid.

About Form 1099-DA. Source: IRS.gov

“The full transaction history from the day the account opened” is what taxpayers need from exchanges, Herbst says. That includes trades, fees, deposits, withdrawals and transaction identifiers, such as the wallets involved.

He says basis follows the asset as it moves between platforms, which means one missing piece of transaction history can affect a gain calculated years later on another exchange.

More data for the IRS, more work for taxpayers?

Andrew Gordon, executive director of Digital Asset Tax Action, says taxpayers are “constantly” struggling to reconcile 1099-DAs with their own records during the 2025 filing season.

He says most crypto tax software lacks tools to import and reconcile 1099-DA information, and the few that do still require manual entry because brokers did not provide the 2025 forms in a machine-readable format.

For active traders, Gordon says, manually entering the information can mean hundreds of individual entries. He argues that brokers should provide a machine-readable file alongside every 1099-DA so the information can flow directly into tax software.

He also says exchanges should maintain complete transaction histories, including acquisition dates, amounts paid, fees and transfers.

Gordon’s concern is that the IRS’s increased visibility doesn’t translate into a complete tax calculation for the taxpayer.

“The 1099-DAs only reported proceeds in 2025, and proceeds reporting gives the IRS visibility it did not previously have;” however:

“Visibility without basis produces the zero-basis problem.”

Taxpayers shouldn’t blindly copy the numbers from a 1099-DA onto their tax return. Duca advises them to compare it against their complete transaction history rather than automatically accepting the form’s figures:

“The IRS expects your return to reflect your actual gains and losses, not necessarily what’s printed on a form that the exchange may have worked out incorrectly.”

Will 2026 make things easier?

While crypto taxpayers are still grappling with the 2025 filing season, more changes are coming down the line.

From 2026, brokers must generally report cost basis for covered digital assets, which will give taxpayers more information to calculate their gains and losses. However, assets transferred to a broker from another exchange or wallet can still fall outside those requirements.

So, the IRS may know more about your crypto trades, but when it comes to working out what you owe, you still need to keep the receipts.

Magazine: Winners and losers of the SEC’s new tokenized stocks rules

An iPhone Safari attack behind recent security warnings hasn’t yet been linked to a confirmed cryptocurrency theft in SlowMist’s investigation.

Multiple reports surfaced this week urging iPhone users to update their devices immediately and warning that malicious Safari pages could expose crypto private keys and seed phrases, with some citing a range from iOS 13 through iOS 26.5.

SlowMist told Cointelegraph that it has not independently confirmed a victim compromised by the specific Safari attack sample it analyzed, while its strongest technical evidence covers iOS 18.4 through 18.6.2.

The company said the “iOS 13 to 26.5” range should be treated as preliminary. “We therefore prefer to avoid stating that iOS 26.5 is affected until there is reproducible technical evidence,” it said.

The Safari attack reuses techniques from a previously disclosed DarkSword exploit chain and is separate from FomoPeek, another SlowMist investigation involving malicious components embedded in an App Store app.

SlowMist finds DarkSword reuse

Google Threat Intelligence Group (GTIG) disclosed DarkSword in March, describing it as an iOS exploit chain that had been used by multiple threat actors since at least November 2025.

SlowMist said MistEye, a threat intelligence team led by its chief information security officer, 23pds, first identified the relevant activity in early May.

SlowMist published its analysis of the WYINCC Safari campaign on Sept. 4, identifying a malicious webpage advertising a free virtual private server service.

SlowMist said the page loaded the exploit code when opened on an iPhone using Safari, without necessarily requiring another click from the user.

The vulnerabilities used in the chain had already been disclosed and patched by Apple, SlowMist said.

What the Safari attack was designed to access

SlowMist found that the malicious Safari sample it analyzed included a component designed to access Apple’s Keychain and retrieve and decrypt information stored there. The code could also access app files and shared app data, potentially exposing information stored by crypto wallet applications.

“The sample demonstrates the collection capability and the intended targets; it does not by itself prove successful extraction from every targeted wallet,” SlowMist said.

Related: EU watchdogs warn quantum computers could pick crypto’s locks

“We did not execute the full chain on a real victim device, so we cannot identify a specific victim whose device we independently confirmed was successfully compromised by this exact sample,” SlowMist added.

SlowMist still recommends updating iOS

Despite the limits of the available evidence, SlowMist advised iPhone users to install the latest iOS security updates available for their devices and avoid suspicious links.

For users who cannot update immediately or face elevated risks, SlowMist recommended considering Apple’s Lockdown Mode as an additional defense, while cautioning that it has not confirmed the feature completely blocks this specific Safari attack.

SlowMist also urged users who believe a wallet key or seed phrase may have been exposed to move their assets to a newly generated wallet on a clean device rather than continue using potentially compromised credentials.

Magazine: Asia dominates Crypto Adoption Index, Bitget’s $352M hack: Asia Express

Security warnings circulating this week about a malicious iPhone Safari attack have prompted renewed calls for iOS updates—particularly over fears that the exploit could be used to steal crypto wallet secrets. However, SlowMist says it has not yet confirmed a real victim whose device was compromised by the specific Safari sample it analyzed, and it cautions that the initially reported iOS versions affected may be wider than what is technically proven.

In an investigation shared with Cointelegraph, SlowMist said the strongest evidence it has supports impact on iOS 18.4 through iOS 18.6.2, while an oft-cited “iOS 13 to 26.5” range should be treated as preliminary until reproducible proof is available. The firm also highlighted that the Safari campaign reuses techniques from the previously disclosed DarkSword iOS exploit chain, and that it is separate from another SlowMist case involving a malicious component embedded in an App Store application tied to the FomoPeek investigation.

Key takeaways

• SlowMist has not independently confirmed a crypto theft or a specific confirmed victim tied to the exact Safari sample it examined.
• The firm’s strongest technical evidence points to iOS versions 18.4 through 18.6.2; broader iOS coverage reported elsewhere is not yet proven.
• The malicious webpage was designed to trigger an exploit via Safari and, once accessed, target Apple Keychain data and other app storage.
• SlowMist links the Safari techniques to DarkSword reuse, while emphasizing this Safari campaign is distinct from its earlier FomoPeek App Store-related investigation.
• SlowMist continues to recommend installing the latest iOS security updates and taking additional precautions such as Apple’s Lockdown Mode and rotating wallet credentials on suspected exposure.

Why the Safari warning is still urgent

The core claim behind the current wave of warnings is that a malicious Safari page could expose crypto private keys and seed phrases. While SlowMist’s analysis supports that the sample includes functionality aimed at collecting sensitive information, it draws a clear line between “capability” and “confirmed success against a particular wallet on a real device.”

SlowMist told Cointelegraph that it has not independently confirmed a victim compromise tied specifically to the Safari attack sample it studied. The company further noted that its investigation did not execute the full exploit chain on a real victim device, limiting the ability to identify an actual endpoint where secrets were successfully extracted.

That distinction matters for both users and defenders: even without confirmed theft, the presence of a plausible collection mechanism is enough to justify immediate defensive steps—especially because seed phrases and private keys are once-off secrets that can’t be safely “partially” exposed.

DarkSword techniques reused in a WYINCC Safari campaign

SlowMist’s write-up ties the Safari attack’s underlying approach to DarkSword, an iOS exploit chain that was disclosed earlier by Google Threat Intelligence Group (GTIG) in March. According to GTIG, DarkSword had been used by multiple threat actors since at least November 2025.

Google’s disclosure described DarkSword as an iOS exploit chain, and SlowMist said its own threat intelligence team—led by its chief information security officer, 23pds—first identified relevant activity in early May. SlowMist then published its analysis of the WYINCC Safari campaign on Sept. 4.

In this campaign, SlowMist said the malicious webpage appeared to advertise a free virtual private server service. When opened on an iPhone using Safari, the page loaded exploit code. SlowMist’s description indicates that the page could trigger the malicious code without requiring an additional click beyond visiting the page.

Importantly for risk assessment, SlowMist said the vulnerabilities employed in the chain had already been disclosed and patched by Apple. That aligns with the practical takeaway for users: applying the latest iOS updates is the most reliable way to reduce exposure to known, patched weaknesses.

What the sample was built to target

Beyond the delivery mechanism, SlowMist focused on what the malicious Safari sample attempted to access. The firm said the sample included a component designed to interact with Apple’s Keychain and retrieve and decrypt information stored there.

SlowMist also said the code could access app files and shared app data—capabilities that may overlap with information stored by cryptocurrency wallet applications. At the same time, SlowMist stressed that this demonstrates collection capability and intended targets, but does not itself prove successful extraction from every targeted wallet.

In other words, the technical evidence suggests a route to sensitive data. But it doesn’t automatically establish that the exploit would work on every device running the affected versions, nor does it prove that any specific wallet compromise occurred in the wild for this exact sample.

SlowMist also cautioned that it did not run the complete chain on a real victim device, which prevented it from independently identifying a specific confirmed victim whose device was compromised by the exact Safari sample.

How SlowMist frames iOS version risk and what to do next

The most sensitive aspect of the reporting has been the breadth of iOS versions claimed to be affected. Some warnings circulating this week cited a wide range from iOS 13 through iOS 26.5. SlowMist told Cointelegraph it views that range as preliminary and prefers to avoid stating that iOS 26.5 is affected until there is reproducible technical evidence.

SlowMist said its strongest technical evidence covers iOS 18.4 through iOS 18.6.2. For users, the practical implication is straightforward even if the exact upper or lower bounds remain uncertain: anyone on an older iOS version should prioritize upgrading to the latest available security release.

SlowMist still recommended updating iOS and avoiding suspicious links. For users unable to update immediately—or those facing higher exposure risk—it pointed to Apple’s Lockdown Mode as an added defense, while also noting it has not confirmed that Lockdown Mode fully blocks this particular Safari attack.

Finally, SlowMist urged users who suspect their wallet key or seed phrase may have been exposed to move assets to a newly generated wallet created on a clean device, rather than continuing to rely on potentially compromised credentials.

With the iOS version scope still being refined and no confirmed victim tied to the exact sample yet established by SlowMist, the next phase to watch is whether further independent technical validation narrows the affected ranges and whether defenders see confirmed real-world compromises tied to the WYINCC Safari campaign.

Bitget CEO Gracy Chen has acknowledged that North Korea was likely responsible for the crypto exchange’s latest hack that stole roughly $352 million.

Substantial withdrawals were spotted from addresses labelled as Bitget hot and cold wallets yesterday, setting off alarm bells across the community.

Crypto investigator Specter Analyst linked the attack to North Korean hacking collective Lazarus Group.

Since then, Chen has confirmed in a livestream that the attack displays the signs of a North Korean operation.

Read more: How 4,000 BTC walked out of Blockstream’s Liquid Network

Chen also revealed that various chains have frozen addresses associated with the hack, and that the Bitget wallet, separate from the exchange, wasn’t affected.

She also ruled out the possibility of a private key compromise, and claimed hackers were able to breach the wallet services backend system, forge transfer details, and authorize their own signing processes.

Bitget’s cold wallets reportedly remained secure while their hot wallets and warm wallet layers were targeted.

Bitget CEO says users funds are covered

Chen claimed user funds were safe, with the majority of the loss covered by Bitget’s User Protection Fund, “which currently holds over $464 million.”

Bitget is now working with independent investigators Mandiant and SlowMist to fully determine what happened. It announced this morning that withdrawels are still temporarily paused.

The Bitget hack was initially expected to involve significantly lower losses, and unfortunately for Bitget, it took place as the exchange celebrated its eighth birthday.

Got a tip? Send us an email securely via Protos Leaks. For more informed news and investigations, follow us on X, Bluesky, and Google News, or subscribe to our YouTube channel.