Daily Crypto Roundup: Bitget’s $388M Breach, UK Crypto Rules, RedCoin & Bitcoin Whiplash

SPEAKER_1 (0:00)

Welcome back to the Daily Crypto Roundup. The Bitget theft did not begin when $388 million started moving. Independent investigators now say malicious code was running inside an exchange-linked security system 25 days earlier. The attackers then used an employee identity and a custom withdrawal tool to make fraudulent transfers look approved. Today, we also have Britain opening its full crypto licensing gateway, HSBC, naming a retail stablecoin, Open USD launching with major payments backing, a 15-year Bitcoin wallet waking up, Kalshi ending an incentive program amid volume allegations, and Bitcoin surrendering a softer inflation rally within two hours. At the time of recording, Bitcoin is around $83,737 and almost unchanged over 24 hours, after trading between approximately $82,923 and $85,518.

Ethereum is near $2,678 and down roughly 1.1%.

XRP is close to $1.50 after losing about 2.6%, while BNB is around $766.60 and up approximately 0.7%.

Solana is near $118.85.

Hyperliquid is close to $85.66 and Cardano is around $24.5.

Chainlink is the weakest of this group, near $14.19 and down approximately 5.5%. Today, Bitget released reports from Slowmist and Mandiant, part of Google Cloud, that materially change what we know about its September 24th breach. Both point to compromise third-party security products, not stolen wallet private keys. Slowmist found the earliest malicious activity on August 31st. A zero-day vulnerability affected a server running an unnamed security product. A hidden script read an environment variable containing a database password and connected to that database.

A similar activity appeared on two more nodes on September 23rd and September 25th. The report's conclusion is blunt. The affected service environments had already been compromised before the assets were transferred out. On the night of the theft, the attackers allegedly used an internal employee identity to enter a second vendor's management platform. At about 4:07 PM Coordinated Universal Time, they began trying to inject commands. At 5:49 PM, a highly-customized withdrawal tool started forging risk control parameters, building withdrawal requests and calling the normal withdrawal process. The first verified on-chain transfer arrived at 6:31 PM. Transfers continued until approximately 9:23 PM. That gave the attackers almost three hours after the first movement. Mandian says they gained privileged access to two security appliances, established command and control access, moved laterally to a production wallet job server and deployed malicious packages. The system apparently approved the theft without surrendering the cryptographic keys. A cold wallet can remain secure while the hot wallet workflow is tricked into signing a bad request. Proof of reserves and cold storage claims are therefore important but incomplete. Authorization design and independent stops matter too. What remains unresolved is equally important. Slow miss did not name the two vendors. Investigators have not completed the path between the first compromised server and the wallet environment. The loss estimate still ranges from $351.6 million to $387.5 million.

The stolen money is becoming harder to recover. Today, 2,746 Zcash entered the ironwood-shielded pool in three transfers, worth about $3.9 million. That is approximately 15% of the stolen Zcash. Investigators can see public entry and exit points, but not a direct link between them. Bitget's timetable says Tether withdrawals across Ethereum, BNB, Smart Chain, Solana and Tron should return from 8 a.m. Coordinated Universal Time today.

Other tokens, fiat services and peer-to-peer access remain scheduled for October 2nd. A timetable is not the same as independent confirmation that every route works under load. Users benefit if the protection fund absorbs the loss and withdrawals keep reopening. Bitget and its vendors lose trust. The interpretation changes if August's event proves unrelated. Or, private keys were compromised after all. Would you accept unnamed vendors in the final explanation? Or should Bitget identify the products so other exchanges can check the same weakness? Watch the completed intrusion path, final loss, October 2nd access and recovered funds. The United Kingdom supplied the second story by opening the Financial Conduct Authority's crypto-authorization gateway today. Firms intending to keep operating in Britain must apply by February 28th, 2027 The full regime begins on October 25th, 2027 This is broader than the anti-money laundering registration that more than 60 firms already hold. Applicants must meet standards for asset safeguarding, consumer protection, market integrity and financial resilience. Authorization is not automatic, and firms that fail cannot keep offering regulated crypto services.

Existing operators that apply within the window may continue taking business if their case remains undecided when the regime begins. That prevents an administrative backlog from switching firms off overnight, but pending is not approved. Dominic Cashman, the regulator's director of authorization, said, Firms can now apply for authorization and start preparing for regulation. What changed is the ability to submit an application.

Customer protections do not fully change today. Well-prepared exchanges gain legitimacy. Weak operators face higher costs or exit. Consumers benefit only if tougher standards produce safer services without crushing competition.