cover

Cosmos Labs disclosed that on September 22, Neutron encountered a governance attack that led to the theft of liquidity from protocols such as Astroport, with approximately 1.73 million ATOM subsequently transferred by the attacker to Cosmos Hub. The Cosmos Hub itself was not attacked, and user funds were not affected. To prevent the stolen ATOM from being transferred out, Hub validators temporarily paused the network for about 24.5 hours and resumed block production on September 23 based on the patched Gaia v28.3.0.Cosmos Labs stated that during the pause, 1.227 million ATOM remained in the attacker's Hub address. When the network was restored, these were transferred to a 4/6 multi-signature address composed of Nansen, Keplr, Enigma, Silknodes, Kiln, and Polkachu through a one-time change. Previously, about 500,000 ATOM had been exchanged for ETH via THORChain and could not be recovered; another 169,000 ATOM entered the attacker's address after the network was restored due to THORChain refunds and were sold after being transferred to Osmosis. The current multi-signature address holds approximately 1.227 million ATOM, which can only be returned after authorization from a Cosmos Hub governance proposal. The related funds will not be staked, lent, or traded. The Neutron team expects to submit a recovery plan and related governance proposals next week.

Bitget TradFi Chief Growth Officer Xie Jiayin issued an update on the platform's security incident, stating that the withdrawal time will be announced before noon tomorrow. The security team has identified the hacker's attack path and methods, and has grasped the details of how the attacker bypassed security measures, coming very close to tracing the source of the attack. The incident investigation by third-party security teams Mandiant and SlowMist is still ongoing, with a detailed report pending from the security team.On-chain tracking confirms that approximately $387.5 million has been transferred to the hacker's address, previously estimated at $351.6 million. This revision includes ZEC and TRX, and no other unauthorized transfers have been found. Xie Jiayin stated that the stolen funds at the platform level will be fully covered by the Bitget User Protection Fund, ensuring that user assets are not subject to any losses.Bitget has officially launched a fund recovery bounty program, offering a 5% bounty for voluntarily freezing the attacker’s funds and a 5% bounty for voluntarily recovering funds. The bounty also applies to assistance already provided. The platform has published the attacker's address, a real-time tracking dashboard, and a submission portal, with relevant information also available for submission through Bybit's Lazarus bounty platform.

Bitget stated that the withdrawal recovery plan will be announced before September 26 at 4:00 UTC (12:00 Beijing time) and thanked users for their patience.Bitget previously confirmed that approximately $387.5 million in assets were transferred to addresses controlled by attackers during this security incident, involving assets such as ETH, XRP, USDT, ZEC, USDC, USDT0, XAUt, BNB, AVAX, and TRX.Bitget claimed that the incident is currently under control, and no further unauthorized transfers have been detected. Withdrawals are temporarily suspended, and investigations and asset tracking are still ongoing.

Binance Co-CEO Richard Teng stated that since the discovery of the security incident at Bitget, the Binance security team has been closely collaborating with Bitget to assist in sharing security intelligence, tracking related funds, and supporting asset recovery efforts.Richard Teng mentioned that in such security incidents, the cryptocurrency industry will unite to respond to attackers, and the relevant assistance work is still ongoing.

Bitget's Greater China Regional Head, Xie Jiayin, tweeted in response to the previous attack incident, stating that the Bitget Protection Fund (currently over $464 million) can cover the losses from this attack, and user assets are unaffected.At 2:31 AM today, Bitget's security system detected abnormal transfers in some hot wallets. The security team immediately activated the emergency response mechanism. The confirmed situation includes: a preliminary assessment of the amount involved is approximately $351.6 million; the cold wallets and the vast majority of platform assets are intact and unaffected.Measures taken include: activating the emergency response team within minutes of the incident, marking and reporting the addresses involved in the abnormal transfers; temporarily disabling the withdrawal function for security reasons, which will be restored in an orderly manner after the security review is completed; notifying law enforcement and on-chain security agencies to intervene in the investigation. The team will provide continuous updates on the status every hour, and the official report will be released within 24 hours, including a root cause analysis and corrective measures. The official will not speculate on the method of attack until the investigation conclusions are clear.

Bitget CEO Gracy Chen stated during a live broadcast regarding the platform's attack incident that some of the affected funds may have a chance of being recovered. Regarding the resumption of withdrawals, Gracy Chen mentioned that Bitget needs to first investigate the relevant issues thoroughly. The technical team is currently advancing system repairs and security enhancements. The platform will only reopen the withdrawal function after confirming the system's security and ensuring that resuming withdrawals will not lead to further attacks by hackers.She stated that once a clear time window for the resumption of withdrawals is established, users will be informed immediately and an announcement will be made. Currently, no specific time can be promised, as the platform does not wish to make commitments that cannot be fulfilled.

The cryptocurrency trading platform Bitget announced on its official X account that on September 24, 2026, at 18:31 (UTC), its security system detected unauthorized transfers from a small number of hot wallets. The security team has immediately initiated an emergency response procedure and started a comprehensive investigation.Bitget stated that, based on current assessments, approximately $351.6 million in assets are affected. Cold wallets and the vast majority of assets on the platform remain secure and unaffected, and user funds are still protected. The incident falls within the coverage of the user protection fund, which currently holds over $464 million.Bitget mentioned that customer account balances remain accurate, and deposits and transactions continue to operate normally. As a precautionary measure, withdrawals have been temporarily suspended to allow the team to complete a thorough security review. The company has identified and flagged the relevant transfer addresses, formally contacted law enforcement agencies and on-chain security partners, and will restore withdrawals as soon as safety is confirmed, providing subsequent updates through official channels while refraining from speculating on the attack path during the investigation.

According to Bitcoin News monitoring, this batch of Bitcoin is worth over 4 million dollars, accounting for about 2.8% of the total Bitcoin related to the Coldcard vulnerability. Crypto Recovery Trust will verify the ownership of the funds and attempt to return them.Alex Thorn, head of research at Galaxy Digital, stated that another 3.0134 BTC was transferred to that address in the same transaction, but its source has not yet been confirmed.

The President of Finland had requested Elon Musk to expand the coverage of Starlink in Russia and the occupied areas to help Ukraine combat Russia's ballistic missile launchers.

According to official news, Gate has launched the world's first stock event contract, expanding the underlying coverage from crypto assets to traditional stocks, supporting bullish or bearish trades in short cycles such as 5 minutes and 15 minutes.As a flexible and efficient short-term trading tool, the Gate event contract has four core advantages: in terms of risk control, the product features zero leverage and low risk, with no forced liquidation or margin call mechanism, and the maximum loss is limited to the initial invested principal; in terms of rules and mechanisms, the criteria for price rise and fall, settlement standards, and transaction fees are all open and transparent throughout the process; in terms of trading flexibility, it supports closing positions at any time, allowing users to control the pace, lock in profits, or stop losses in a timely manner; in terms of participation threshold, it only requires an investment of 5 USDT to start, helping investors quickly implement short-term strategies.Currently, the official incentive program has been launched simultaneously. The second phase of the Gate event contract limited-time trading competition officially started on September 21 at 16:00 (UTC+8) and will continue until October 1 at 08:00 (UTC+8). The event includes rewards for first trades and consecutive trades for new users, daily trading volume tiered rebates for all participants, and a grand prize for cumulative trading volume leaderboard, with participating users having the chance to win a prize pool of up to 12,500 USDT.

The Cosmos ecosystem protocol Neutron faced a governance proposal that was manipulated by an attacker. The related address spent approximately 20,199 USDC to buy NTRN and staked 31.6 million NTRN about 12 minutes before the voting ended, ultimately allowing the proposal to pass with an 82% approval rate. Subsequently, the management rights of 11 contracts were transferred to the attacker, and they migrated to malicious code, stealing approximately 4.4 million dollars in assets.To recover the funds, Cosmos Hub validators coordinated a chain halt for nearly 24 hours and 48 minutes, and during the restart process, approximately 1.23 million ATOM were transferred from the attacker's wallet to a new address, with plans to return them to the original holders.

The Binance Wallet's stablecoin fee payment feature now supports transfers on the TRON network, allowing users to not hold TRX.Starting today, when users transfer USDT and other TRC-20 tokens on the TRON network through Binance Wallet, they can directly select USDT as the network fee payer, without needing to hold TRX as Gas.For example, to send JST, users only need to open the Binance Wallet, click "Send" → "Select Token" → "Network Fee Payer" → "USDT," to complete the setup and have the network fee covered by USDT. This feature further simplifies the asset transfer process on the TRON network, lowering the threshold for users to hold native tokens, making cross-asset transfers easier and more convenient.

The President of the United States, Donald Trump, stated that he is working to restore smooth oil transportation in the Strait of Hormuz.

White hat actors transferred 40.71 bitcoins related to the Coldcard vulnerability into a single transaction, valued at approximately 3.31 million dollars. This transaction aggregated funds from 11 addresses and included OP_RETURN information pointing to the Crypto Recovery Trust.Alex Thorn, head of Galaxy Research, revealed that a larger aggregation transferred a total of 52.37 bitcoins, involving multiple clusters of attacker addresses, accounting for about 2.8% of the funds involved in the vulnerability. A firmware flaw in Coldcard devices from March 2021 led to insufficient randomness in the mnemonic phrases, with the peak amount of funds involved being approximately 130 million dollars.

According to CoinDesk, the European Central Bank (ECB) and the central banks of EU member states wish to prohibit crypto platforms from providing indirect yields on stablecoins through lending, staking, and other products. The European System of Central Banks (ESCB) stated in response to the European Commission's consultation on the review of the Markets in Crypto-Assets Regulation (MiCA) that electronic money should be used for payments rather than savings, continuing to support the prohibition of crypto asset service providers (CASP) from paying rewards for stablecoins, and that the ban should not be limited to services already regulated by MiCA but should also cover unregulated activities such as crypto lending, borrowing, and staking.Central banks believe that allowing indirect yields could blur the lines between electronic money and bank deposits, distorting the fair competitive environment of the EU financial system. The ESCB stated that maintaining and, when necessary, strengthening this ban, while covering both direct and indirect forms of rewards, should be a clear legislative priority. This position also echoes the controversy in the U.S. surrounding the Clarity Act, where eight U.S. banking groups urged senators to tighten the bill's restrictions on stablecoin rewards, which ultimately failed in a procedural vote of 49 to 50.In addition, central banks also proposed to eliminate the MiCA requirement for stablecoin issuers to hold part of their reserves in the form of bank deposits, replacing it with liquidity rules based on the liquidity of reserve assets. Currently, stablecoin issuers must keep at least 30% of their reserves in credit institutions, and this percentage rises to 60% for those classified as significant stablecoins. The ESCB suggested that significant stablecoins must allocate at least 40% of their reserves to assets maturing within one day and 60% to assets maturing within five working days, while the corresponding thresholds for non-significant stablecoins are 20% and 30%.

Bitcoin News posted on the X platform that Bitcoin Core developer Niklas Gögge warned that recent AI-driven vulnerability scanning is changing the security landscape of Bitcoin. Large language models have significantly reduced the cost of discovering vulnerabilities, allowing attackers to potentially find catastrophic vulnerabilities for just a few hundred dollars in computing costs.For Bitcoin Core, Project Loupe, the Bitcoin Red Team, and individual contributors have generated over 1,000 reports, but so far no high-risk or severe vulnerabilities have been found. Gögge stated that relying on stronger models to discover vulnerabilities before attackers is not a sustainable security strategy. Developers should build testing infrastructure that can proactively prevent entire classes of vulnerabilities through automated testing, fuzz testing, and property-based testing. Key components of Bitcoin Core have accumulated over 100 years of CPU fuzz testing and have undergone decades of Bitcoin node network simulation.

According to The Block, World is launching World Money, a self-custody financial super app that encompasses stablecoins, investments, yield, and global payment features, covering over 150 countries.The app integrates with Stripe, Kalshi, and Morpho, allowing users to unlock higher rewards through World ID verification. World was previously known as Worldcoin, co-founded by OpenAI CEO Sam Altman and others.

Standard Chartered Bank has initiated coverage of Arbitrum's ARB token, predicting it will rise from approximately $0.14 to $10 by the end of 2030, citing revenue from networks like Robinhood Chain.The bank also warns that ARB holders cannot directly share in Arbitrum's revenue, and there are risks such as a slowdown in the tokenization process and competition from peers.

The U.S. government oversight agency released a report acknowledging a shortage in the inventory of advanced weapons for the U.S. military, and disclosed the damage to military aircraft, military bases, and diplomatic facilities in the Middle East.The report pointed out that the war has led to a "strategic inventory shortage," exposing bottlenecks in the military-industrial capacity for ammunition replenishment. Experts estimate that it may take the U.S. military about three years to restore inventory to pre-war levels.