This Week in Crypto (September 21–28): Bitget Loses $351.6M to a Spoofed Authorization, the Fed Writes the Stablecoin Rulebook, and Bond Yields Hit a Nineteen-Year High While Crypto Rallies Anyway

Two things happened this week in crypto that are not supposed to happen together. The 10-year Treasury yield broke above 5.1% on September 23, its highest in nineteen years, and bitcoin rallied into it while $2.4 billion of ETF money arrived. Then Thursday supplied the counter-argument: $351.6 million out of Bitget's hot wallets, and no stolen private key anywhere in the story. The Fed proposed the first GENIUS Act stablecoin rules the same afternoon. Here's the week, story by story.

The week at a glance

Bitget lost $351.6 million without anyone stealing a key

At 18:31 UTC on September 24, Bitget's monitoring caught unauthorized transfers leaving its hot wallets. CEO Gracy Chen put the figure at $351.6 million within hours and suspended withdrawals, keeping deposits and trading online — the largest exchange breach reported in 2026.

The mechanism is why it matters. Per Chen, the attacker compromised a backend system inside the wallet infrastructure, spoofed transaction data, and triggered Bitget's own authorization process to approve transfers that should never have cleared. Private keys were never touched. Funds moved across ETH, BNB, AVAX and USDT rails into one address.

On X: @GracyBitget — "Bitget's security systems detected unauthorized transfers from some of our hot wallets."

On X: @WuBlockchain — Chen's team found IP addresses whose VPN patterns matched a DPRK-linked group. Attribution by pattern, not indictment.

Bitget says its $464 million User Protection Fund covers the loss, with withdrawals returning in stages from September 28 to October 2. Two soft edges: its support pages later revised the figure to roughly $387.5 million, and while Chen says cold wallets were untouched, both CoinDesk and Hacken initially described cold-wallet movement. A balance you cannot withdraw for four days is a claim on a company, not a coin you hold — the difference between custodial and non-custodial is this week's lesson, and our Super Wallet generates keys on-device for that reason.

The Fed put reserve and capital numbers on private dollars

Hours before the Bitget alert, the Federal Reserve Board requested comment on two proposals covering Board-supervised payment stablecoin issuers under the GENIUS Act. The first requires issuers to "fully back their stablecoins with certain permissible reserve assets, such as short-term Treasury bills and certain other high-quality, liquid assets," and adds standardized capital requirements. The second creates an application pathway for supervised banks. Comments close 60 days after Federal Register publication.

The timing was almost comic. Two days earlier the rails had gone live: SoFi Bank's $25 billion card program now settles in SoFiUSD, with merchants receiving funds in a bank account without holding the token.

On X: @SoFi — "the first national bank to go live with stablecoin settlement across Mastercard's global payments network."

Binance also put $100 million into Circle on September 22 under a five-year deal to promote USDC — distribution bought to contest Tether internationally. So the rulebook arrives after the rails, which is the normal order in payments and the reason the capital requirement is the clause to read. Our explainer on the GENIUS Act covers what the statute required; this decides who can afford to comply.

The 10-year hit 5.127% and crypto went up anyway

On September 23 the 10-year Treasury yield jumped about 18 basis points to 5.127%. October rate-hike odds moved to 73.1% from roughly 50%, and by September 28 the 10-year printed 5.21%. On the old playbook that is a risk-asset liquidation.

Instead bitcoin ran from $83,502 on Monday morning to an intraday high above $87,000, faded to $84,400 as yields spiked Wednesday, and sat near $84,602 on Sunday — higher on the week. The setup was September 20's weekly close, bitcoin's first above its 50-week moving average in 45 weeks.

On X: @intangiblecoins — "BTC CLOSES WEEK ABOVE 50-WEEK MOVING AVERAGE FOR FIRST TIME IN 45 WEEKS… bitcoin is up 29% in 35 days."

The honest read is that flow beat rates for one week. Yields broke out on a stronger-than-expected PMI print, not new Fed guidance, while crypto absorbed it with $2.4 billion of ETF demand and roughly $648 million of shorts liquidated around Monday's high. One number argues against extrapolating: BTC spot volume fell 36% to $38 billion, so this was a thin tape.

Bitcoin ETFs took $2.4 billion, and the daily table is the real story

US spot bitcoin ETFs pulled in $2.4 billion in the week to September 25, their best week since October 2025, flipping 2026 net flows positive for the first time since July. The year had been $5.8 billion in the red on July 13; it now stands at plus $934.1 million — BlackRock's IBIT took $1.2 billion of the week. Ether funds added $689.9 million after losing $140 million the week prior.

On X: @TheBlockCo — "their best week since October 2025… 2026 net flows positive for the first time since July, when they were nearly $6 billion in the red."

The shape matters more than the total:

Demand decayed every session, and Monday alone beat Wednesday through Friday combined — a bid front-loaded into the breakout and thinning as yields climbed, which is how "$2.4 billion week" and "momentum fading" are both fair readings.

The kicker: $20,199 bought a governance takeover, and a live chain halted itself

On September 22 an attacker passed a Neutron governance proposal titled "AI Agent Takeover," seized admin control of Astroport and Drop, and drained $4.9 million and $4.4 million from their contracts. The reported cost of the NTRN needed to carry the vote was $20,199. Nothing was exploited in the usual sense — the vote passed and the contracts obeyed it.

What followed was stranger. The attacker moved roughly 1.73 million stolen ATOM to the Cosmos Hub, which was not itself compromised, and Hub validators halted the network anyway, shipped Gaia v28.3.0, and used it to redirect about 1,227,121 ATOM into a 4-of-6 multisig held by six community validators.

On X: @cosmoshub — "validators have temporarily halted the network to mitigate ATOM losses from a governance exploit on @neutron_org. The Hub itself is not affected."

Block production resumed at 12:00 UTC on September 23 after about 24 hours and 48 minutes down. The seized tokens cannot reach their owners without a Cosmos Hub governance vote — a chain that stopped itself to intercept a governance attack now needs governance to finish the job.

Also this week

• Blockstream's September 23 Liquid report shows the first fix created the second bug. The August 3 patch for a 2018 rangeproof caching flaw concatenated cache fields without length prefixes, opening the hole used on September 6. Of ~4,000 BTC taken, 3,400 came back; ~602 BTC and peg-outs are outstanding.
• Fairshake committed $30 million against Sherrod Brown, six days after CLARITY died. The crypto PAC is backing Jon Husted in Ohio — 2.5x what it spent there in 2024.
• CME will list Bitcoin Cash and Uniswap futures on October 19. Announced September 22 pending review; BCH jumped roughly 30% to about $350.
• New York sued Polymarket on September 24, and Polymarket sued back. AG Letitia James alleges unlicensed gambling reaching New Yorkers as young as 18; Polymarket says its contracts are federally regulated derivatives.

What to watch next

Four checkpoints carry the next fortnight: September 28 to October 2, Bitget's phased withdrawal restart; October 19, the CME listing; the October FOMC, priced at 73.1% for a hike; and late November, when the Fed's comment window closes. If this week has you reconsidering how much sits on an exchange, our wallet security documentation covers the checks worth running first. Most threads from last week's roundup are still open.

Last updated: September 2026