Crypto’s security bill came due this week, and it arrived itemised. In seven days the industry booked a $387.5 million exchange breach, took a $292 million bridge failure to court, moved 3,832 NFTs into protective custody, and — the most expensive admission of all — rolled a layer-1 blockchain back by an entire month. Four incidents, four teams, one structural failure repeated four times: the industry keeps its security promises in processes and configuration instead of protocol invariants.
That is not a moral judgement, it is an engineering one. Nobody invented a new class of attack this week. Attackers walked through trust paths that were already there — an exchange’s signing backend, a single cross-chain verifier, a feature added to make integration easier, and an NFT approval granted years ago and never revoked.
Here is what happened, in order, followed by the only question worth asking of every “security upgrade” announced in the next month: does it remove trust from the system, or just move it somewhere less visible?
September’s security ledger (Sept. 24–28, 2026)
| When | Project | Reported loss | Where the failure lived |
|---|---|---|---|
| Sept. 24–25 | Bitget | $387.5M (first reported at $351.6M) | The backend of the wallet service: forged transfer data fed into the authorization-signing flow |
| Sept. 25 | KelpDAO v. LayerZero | $292M (exploit dated April 18) | A single LayerZero verifier path approved a forged cross-chain message |
| Sept. 25 | Magic Eden | ~$5.7M of NFTs exposed | Legacy approvals still live on old marketplace contracts |
| Sept. 28 | Zano | ~1 month of chain history invalidated | Gateway Addresses (Hard Fork 6) allowed unauthorized ZANO and fUSD issuance |
| Sept. 24–28 | THORChain | $0 lost, reputation spent | Refusal to blacklist addresses linked to the Bitget hack |
One caveat before the detail: loss figures in live incidents are moving targets. Bitget’s own tally started at $351.6 million and was revised up to $387.5 million. KelpDAO’s $292 million is the value of 116,500 rsETH at the time of April’s exploit, not the value of the incident filed in court this week. Treat every number below as a snapshot, including ours.
Bitget: the wallet that has to stay online
Bitget disclosed “unauthorized transfers” affecting parts of its hot and warm wallet infrastructure on Sept. 24 and suspended withdrawals while it investigated. In a live Q&A the following day, CEO Gracy Chen said attackers had compromised a backend system of the wallet service and used it to forge transfer information that was passed into the exchange’s authorization-signing process.
Her account is specific, and worth reading carefully: the attackers did not forge user withdrawal requests, and they did not obtain private keys to the cold, hot or warm wallets. If that holds, the lesson is not “Bitget had weak keys.” It is that a signature is only as trustworthy as the request pipeline that fills it in. The chain did exactly what it was told to do — which is the eternal problem with using a public ledger as your audit trail while trusting a private service to decide what the ledger gets told.
Chen said preliminary findings matched IP addresses to VPN services used by a North Korean group, and that the exchange does not believe the breach was an inside job. Onchain researcher Specter traced part of the stolen XRP to an Ethereum address whose funding history overlaps a wallet previously tied to the AFX exploiter — a project whose own post-mortem pointed at TraderTraitor, a North Korea-linked group. That is pattern-matching, not proof, and Bitget framed it that way. But North Korea-linked theft reached an estimated $2.02 billion in 2025, including the roughly $1.5 billion Bybit hack, so the prior probability behind the claim is uncomfortably high.
Some funds have reportedly been recovered. The deeper issue is why the exposure existed at all. Hot and warm wallets exist because a withdrawal that takes thirty minutes is a lost customer. That is a business decision, and a defensible one — but it is a decision to place the security boundary inside an online service rather than at a cryptographic invariant. When that boundary fails, onchain immutability is not a defence. It is the weapon.
THORChain: what an invariant actually costs
The second-order fight is more instructive than the breach. Chen publicly called on THORChain — the protocol where much of the Bybit hack’s funds were swapped — to block the addresses tied to her exchange’s stolen funds: “Decentralization is a design principle, not a shield for facilitating known stolen funds.” THORChain declined.
Both sides are paying a real price, which is why this debate never resolves cleanly. Chen is asking a permissionless system to adopt the exact compliance primitives regulators have spent a decade demanding from exchanges. THORChain’s refusal preserves an invariant its users rely on — but it also means a sanctioned state actor can swap stolen assets through it, and “we don’t do blacklists” rings hollow when the system’s operators can pause the chain at will. They did exactly that in May, when THORChain itself was hacked for $10.7 million. The project says it retired its admin key back in February 2025, which raises an awkward question it has not fully answered: what, precisely, would it use to comply if it wanted to?
That is the pattern worth remembering. A property that can be switched off by five people in a chat group is not an invariant; it is a configuration. Invariants are the things that stay true on the worst day, not the ones described in a blog post. Note what happened next: RUNE rose roughly 50% in a week. Being publicly accused of laundering is, in this market, a marketing event.
KelpDAO v. LayerZero: when the guarantee lives in a document
On Sept. 25, KelpDAO sued LayerZero and CEO Bryan Pellegrino over the April 18 exploit that drained 116,500 rsETH — about $292 million at the time — from Kelp’s LayerZero-powered bridge. Kelp’s position: LayerZero failed to disclose risks and, in writing, reviewed and endorsed the bridge’s deployment and configuration before the attack. Pellegrino’s substantive response was one word — “meritless” — and he says he will defend the case in Vancouver.
LayerZero’s final incident report describes a compromised internal node and a verifier that approved a forged cross-chain message. Its argument is that the loss was possible because Kelp’s bridge used a single LayerZero decentralized verifier network (DVN) as its only verification path, and that it had recommended running more than one. Kelp says that configuration was previously discussed and “confirmed as secure,” and has since announced it will migrate the rsETH bridge to Chainlink’s interoperability protocol.
Set aside who wins. The structural fact is that a multi-hundred-million-dollar security guarantee was, at the decisive moment, a document: a recommended configuration, a review, an endorsement. Nobody wrote the requirement into the protocol — “two independent verifiers must sign before value leaves” — which is the only place it would have been enforced automatically. Controls that live in reviews and emails are not controls. They are debts with a floating interest rate, and the interest is paid by whoever is holding the tokens when the forged message lands.
Zano: the most honest expensive decision of the week
Zano, a privacy-focused layer-1 launched in 2019, restarted its chain at block 3,833,000 — the block immediately before Hard Fork 6 — after a vulnerability in Gateway Addresses let unauthorized ZANO and Freedom Dollar (fUSD) tokens enter circulation. The rollback invalidates roughly a month of history: legitimate transactions from that window no longer exist on the recovered chain, and payments already settled on other blockchains cannot be reversed at all. Nodes, miners, stakers, exchanges and services all had to adopt the update, and the team says it will publish a reimbursement and claims process.
Trace the engineering, because it is a textbook sequence. Gateway Addresses were introduced to make life easier for bridges, exchanges and payment providers by handing them account-style balances instead of forcing them to scan for individual UTXOs. That is a first-order business feature — it lowers integration cost and it wins listings. It also moved the protocol’s trust model, quietly, in the direction of “one account can mint into the system if the logic is wrong.” When the logic was wrong, the only remaining remedy was the one tool that should never be needed: rewriting the chain.
Zano’s team is unusually blunt about the trade-off. “Restarting the chain from before Hard Fork 6 costs a month of history, and it costs trust, which we’ll have to earn back,” said head of marketing and growth Quinten van Welzen. “But it restores the supply everyone signed up for… We know it hurts. But not doing it would have hurt more.”
He is not wrong, and that is the uncomfortable part. Doing nothing meant unlimited dilution of an asset whose basic promise is a fixed supply — plus a signal to every future attacker that exploited coins keep their value. But be clear about what was decided: finality was treated as a configurable parameter, and the switch was flipped by the core team. That is not decentralisation failing. It is decentralisation that was never fully paid for, and the invoice arrived as a month of legitimate history.
Magic Eden: approvals are a subscription you forgot you bought
On Sept. 25, a single wallet moved 3,832 NFTs out of hundreds of wallets in transactions that appeared as sales on Magic Eden. Community member Cirrus flagged the activity publicly and told holders to revoke permissions; Yuga Labs’ vice president of blockchain, 0xQuit, identified it as a whitehat rescue — the NFTs are safe and will be returned once they are no longer at risk. The Block reported that roughly $5.7 million of NFTs were exposed before the rescue.
There is no villain here, and that is the point. The exposure came from legacy approvals: permissions granted to old contracts that keep working long after the product, or the team behind it, has moved on. Nobody audits them. Nobody revokes them. They accumulate for years, and they are the least dramatic, most predictable line item in crypto’s security budget. The only cure is operational hygiene — revoking what you no longer use, exactly as you would remove a former employee’s access.
The one idea pointing the other way
Before leaving the SEC on Oct. 2, Commissioner Hester Peirce made the week’s most useful engineering argument: that hoarding identity documents online creates databases that get hacked, and that zero-knowledge proofs let a user prove eligibility without handing over a name, income or address. It is the same principle in reverse. Instead of trusting a company to hold your data safely, you verify without disclosing it.
That is what a real security improvement looks like: it removes data and trust from the path, rather than protecting them better inside the path. Keep that test in mind when you read the incident reports that will follow this week’s breaches — most will promise a stronger lock on a door that should not have existed.
Why the market barely blinked
Here is the number that should bother you more than any breach. Over the same stretch in which close to $680 million of value was stolen, invalidated or placed at risk, Bitcoin traded around $83,700–$84,200, up roughly 3.8% on the week. Ether sat near $2,660. Total market capitalisation held around $2.87 trillion, with Bitcoin dominance near 59%. Bitcoin ETFs notched a seven-session inflow streak, adding about $2.4 billion in a single week — their largest inflow since October, and enough to turn 2026 flows positive, according to The Block.
Read those two facts together. Institutional money is arriving through a wrapper that carries no exchange custody risk, while the users who supply spot exchange liquidity absorb the losses. The market is not saying that security does not matter. It is pricing these incidents as a recurring operating expense rather than a systemic risk — and as long as that pricing holds, the incentive to actually pay down the debt stays weak.
A checklist for telling a fix from a new debt
Every project involved this week will announce a hardening plan. Most will be defensible. Some will simply move trust somewhere less visible. Six questions separate the two:
- Does it remove people and processes from the trust path, or add them? If the fix depends on more humans being careful, you have bought insurance, not architecture.
- Is the guarantee enforced by code or by policy? “Two independent verifiers must sign” is code. “We recommend two verifiers” is a wish.
- What is the defined failure mode, and who can trigger it? Zano can answer this precisely, which is more than most projects can. Its answer was “rewrite a month of history.”
- How many approvals stand between an attacker and the funds, and where is that threshold written? In a multisig or threshold-signing setup it is inspectable. Inside a backend service, it is a promise.
- Does it follow the architecture the largest operators already run — multi-verifier bridges, threshold signing, hardware key management — or a bespoke scheme only its authors understand?
- Can the improvement be measured? Loss per quarter, approvals revoked, verifiers that are actually independent. A security programme that cannot be quantified is marketing with a budget.
What to watch next
- KelpDAO v. LayerZero — a ruling on bridge responsibility would set the default for how integration risk is priced across DeFi.
- Bitget’s recovery and post-mortem — above all, whether the signing pipeline is rebuilt around hardware-enforced policy or merely re-tuned process. Withdrawals and the final loss figure still need to settle.
- Zano’s claims process — how a rollback compensates users whose valid transactions it erased is the real test of whether this was a rescue or a quiet transfer of loss.
- Multi-verifier defaults — LayerZero says it no longer acts as the sole required verifier, and Kelp has moved to Chainlink CCIP. Watch whether single-verifier configurations survive the next audit cycle at all.
- THORChain’s answer — if it cannot say what mechanism it would use to comply, the debate over whether it should is academic.
FAQ
How much did Bitget lose in the September 2026 hack?
Bitget initially reported $351.6 million in unauthorized transfers, then revised the figure to $387.5 million as tracing continued. The exchange suspended withdrawals while investigating and says some funds have been recovered.
Did Bitget lose private keys?
No. CEO Gracy Chen said attackers compromised a backend system of the wallet service and forged transfer information that was passed into the authorization-signing process, without obtaining cold, hot or warm wallet private keys.
Was North Korea responsible for the Bitget breach?
That is preliminary, not proven. Bitget cited IP addresses matching VPN services linked to a North Korean group, and an independent onchain researcher reported funding histories overlapping an address tied to a North Korea-linked exploiter.
Why did Zano roll back its blockchain?
A vulnerability in Gateway Addresses let unauthorized ZANO and Freedom Dollar tokens into circulation, diluting holders of a fixed-supply asset. The team restarted the chain at the block before Hard Fork 6, which also invalidated roughly a month of legitimate transactions.
What happened with Magic Eden’s NFTs?
A whitehat operator moved 3,832 NFTs out of hundreds of wallets into protective custody after legacy approvals left them exposed. The NFTs are reported safe and will be returned to holders.
Did KelpDAO’s lawsuit succeed?
It was filed on Sept. 25, 2026 against LayerZero and CEO Bryan Pellegrino. Pellegrino has called the claim meritless and says he will defend it in Vancouver. No ruling has been issued.
Method note: This analysis applies the technical-debt framework of Chinese engineer Chen Hao (左耳朵耗子, 1976–2023), who argued that every architecture decision is a loan: trace what it replaced, name the interest, and quantify the benefit before calling it elegant. Market data are snapshots taken on Sept. 28, 2026 via CoinGecko.
Disclaimer: This article is for informational purposes only and is not investment advice. Loss figures in active incidents change as investigations progress, and cryptocurrency markets are highly volatile. Always do your own research.
Track live prices, market rankings and the latest crypto news on BBVN Markets.
