Bitget Reveals $352M Backend Breach | Bitcoin ETFs Turn Positive for 2026 | Ethena Adds Tokenized Stocks | Daily Crypto Roundup.
Crypto News Today
September 25, 2026
Kraken Ledger NordVPN Spotify Bitget says attackers stole $351.6 million by compromising a wallet backend and spoofing transaction data—not by taking private keys. Stablecoin issuers froze one exploiter address, but most of the loss remains in Ether.
TopicsTechnology
SPEAKER_1 (0:00)
Welcome back to the Daily Crypto Roundup. Bitget's attackers did not steal the exchange's private keys. Today, Chief Executive Gracie Chen said they compromised a wallet back end, spoofed transaction data and made fraudulent transfers look authorized. Stablecoin issuers have frozen one exploiter wallet, but almost all of the $351.6 million loss remains beyond that reach. We also have Bitcoin funds turning positive for 2026, tokenized stocks entering USDe's backing strategy, and a major Solana oracle reaching the end of support. At the time of recording, Bitcoin is around $84,000, up approximately 0.4% over 24 hours after trading between about $83,250 and $85,205.
Ethereum is near $2,696 and up roughly 1.4%.
XRP is close to $1.59 after gaining about 6%, while BNB is around $776 and almost unchanged. Solana is near $120.70 and higher by approximately 5.3%.
Hyperliquid is close to $92.30 and Cardano is around $0.26.
Chainlink is the strongest move in this group, near $14.05 and up approximately 12.5%.
Does today's Bitget explanation make you more confident because the private keys survived? Or less confident because an internal approval system accepted forged data? Kraken is the platform we use ourselves and trust for buying and trading crypto. New Kraken users who sign up using our link in the description can claim 20 XRP from Crypto News Today. Availability and eligibility vary by region. The 20 XRP is supplied by Crypto News Today, not Kraken. Using our link supports the show and helps keep the podcast free from outside advertising. If you already use Kraken, please leave Crypto News Today a five-star rating on Spotify. This is not financial advice. Crypto trading involves risk of loss. The lead story is the first detailed account of how Bitget lost $351.6 million.
The unauthorized transfers began at 6:31 p.m. Coordinated Universal Time on September 24th, so the breach itself happened yesterday. What changed today is the mechanism, the containment claim and an on-chain freeze.
Chen said an attacker entered a critical back-end system inside Bitget's wallet infrastructure, used it to spoof transaction data, and triggered the normal authorization process. She said, Private key compromise has been ruled out.
That distinction matters, but it is not automatically reassuring. A compromised approval system can make bad instructions look legitimate before signing. The vault key stays secret, but the process deciding what it should approve has failed. Bitget says the attack reached hot wallets and the warm wallet layer that replenishes them, while offline cold wallets remain secure. The company says further unauthorized transfers are no longer possible, deposits and trading remain open, and withdrawals are suspended during the security review.
It has not provided a reopening time. Bitget also says its user protection fund holds more than $464 million and can cover the loss. That is a company commitment, not proof that every withdrawal will clear normally. The next test is fund deployment and a technical report that outsiders can evaluate. Circle and Tether supplied the first recovery action today. Circle blacklisted an address labeled Bitget Exploiter 8 at 5 a.m. Coordinated Universal Time, and Tether also banned it. The address holds about $218,023 USDT and $99,990 USDC, leaving roughly $318,000 in stable coins frozen. That sounds useful until you compare it with the full loss. Other exploiter addresses still hold more than 63,000 Ether, which has no centralized issuer able to freeze it. The action recovered control over less than one-tenth of one percent of the reported loss. Users benefit if the protection fund makes them whole and withdrawals reopen safely. Bitget loses trust if a backend can manufacture approved transfers. The containment claim fails if another unauthorized movement appears, withdrawals return with restrictive limits, or the published root cause cannot explain the bypass. Would you resume using an exchange after full reimbursement, or would the failure change where you keep long-term holdings? The second story is the completed evidence behind Bitcoin's institutional rebound. United States' spot Bitcoin exchange-traded funds have now erased a $5.8 billion deficit and moved to nearly $800 million of net inflows for 2026 Six consecutive positive sessions brought in $2.84 billion.
On July 13, the same products were down $5.8 billion for the year. Almost $4 billion has arrived since August. While Bitcoin recovered from below $58,000 in early June to around $84,000 today. The comparison still demands restraint. The 2026 total remains tiny beside $35.2 billion in 2024 and $21.4 billion in 2025
Six positive days do not guarantee a seventh, and Bitcoin is still below Monday's high. Today also completed the quarterly options expiry we flagged earlier this week. Deribit's September Bitcoin contracts expired at 8 a.m. Coordinated Universal Time using a 30-minute index window.
The roughly $16.1 billion figure reported before expiry measured outstanding notional, not a cash bill that changed hands this morning. Some options expired worthless.
5 more minutes of transcript below
Thousands of transcripts fetched by people building searchable podcast archives
Fetch the whole transcript
The demo key returns a sample episode in full, no card needed:
curl -H "x-api-key: pt_demo" \
https://spoken.md/transcripts/1000651996090Markdown with the speakers named, for your notes, your knowledge base, or anything that makes HTTP calls.
From $0.10 per transcript. No subscription. Credits never expire. Prices exclude VAT, added at checkout for EU customers. Not what you expected? Email us within 14 days with 20 or fewer credits used and we refund the pack in full.
Using your own key:
curl -H "x-api-key: YOUR_KEY" \
https://spoken.md/transcripts/1000791657481