Crypto Transaction Weekly News Review - September 21 - 27, 2026

Security and Incidents: One Week, One Record Breach, Four Smaller Ones

1. Bitget Loses $387.5M to a Supply-Chain Attack on Its Wallet Backend

Event date: September 24, 2026 (revised estimate September 25; issuer freezes reported September 27)

Source: Bitget statements by CEO Gracy Chen; Arkham Intelligence tracing; Coin360 incident accounting; PeckShield and EmberCN reporting; Mandiant and SlowMist engagement.

Summary: Bitget's security system detected unauthorized transfers at about 18:31 UTC on September 24, and the drain continued for nearly three hours before withdrawals were paused. Arkham Intelligence traced roughly $350M leaving five Bitget wallets across seven chains - XRP Ledger, Ethereum, Arbitrum, Optimism, BNB Chain, Avalanche and Base - with $228M of it compressed into 18 minutes (18:58-19:16 UTC). XRP was the largest single component at roughly 103 million tokens, about $157M at the September 25 accounting, and the attacker's ETH holdings grew past 63,000 ETH as stolen stablecoins were converted. Bitget first confirmed $351.6M, then raised it to $387.5M on September 25 after fuller accounting added Zcash and TRON transfers - the company stressed this was better accounting, not new theft. CEO Gracy Chen said no private keys were compromised: a third-party tool used by Bitget's wallet infrastructure was breached, and forged transfer instructions were fed to the signing machines. Withdrawals were paused while Mandiant and SlowMist ran the forensics; a phased restoration schedule was announced September 26, with withdrawals resuming progressively from September 28. A 5% recovery bounty was posted, and the exchange pointed to its $464M user protection fund. By September 27, Circle and Tether had frozen a hacker-linked wallet holding about $318,000 in USDT and USDC combined, and PeckShield and EmberCN reported that the larger share of funds had moved to a wallet linked to market maker Wintermute - unconfirmed and not yet explained.

My take: The headline numbers here need separating: $387.5M is what reached attacker addresses, not what the exchange or its users will ultimately lose - the protection-fund claim does the absorbing. The structural lesson is the one this column keeps returning to: the keys were fine, and the process around them was not. A signing machine that obeys forged instructions is a key with extra steps.

2. Payy Network's Ethereum Bridge Drained of Its Entire Balance

Event date: September 24, 2026

Source: Payy Network confirmations; Specter on-chain alerts; Protos incident reporting, September 25.

Summary: The bridge connecting Payy Network - a rollup offering on-chain payroll and treasury services - to Ethereum was drained of its entire balance, about $1.8M. Pseudonymous investigator Specter first flagged suspicious withdrawals; the attacker, funded through the privacy protocol Railgun, swapped the $1.8M of USDC for ETH. Payy confirmed the exploit, paused all operations, and said the funds were users' non-custodial deposits to Payy Network and Payy Wallet. The cause had not been disclosed as of week end.

My take: Small by this week's standards, but note what made it possible: a bridge that held everything in one place. Whole-balance drains keep happening to bridges whose security model has no throttle between a bad day and total loss.

3. Crypto Casino Duelbits Hit for About $7M in Suspected Key Compromise

Event date: September 24, 2026

Source: PeckShield initial tally; Specter address analysis; Duelbits co-founder statement; Protos and CoinMarketCap reporting.

Summary: Duelbits, a crypto casino and sportsbook, lost an estimated $7M in what its own co-founder characterized against a background of suspected private key compromise - the estimate itself climbed in public: PeckShield's first tally was $4.3M, Specter raised it to $5.9M after finding affected addresses on Bitcoin and Solana, and the co-founder put the final figure near $7M. Funds touched multiple chains including TRON, and the platform went offline for investigation. Duelbits was previously hacked for $4.6M in 2024, in an incident CertiK also attributed to a suspected key compromise.

My take: Two key-compromise incidents at the same operator in two years is a pattern, not bad luck. For any treasury touching TRON, Bitcoin and Solana at once, the surface area of key management is the risk, whatever the games pay out.

4. Meter Minted Unbacked Tokens Through a Block Validation Flaw

Event date: September 23, 2026, 21:14 UTC (disclosed September 24)

Source: Meter team statements on X; Protos reporting, September 25; PancakeSwap price data.

Summary: Meter.io, an EVM blockchain, saw unbacked tokens minted through what the team called a block validation flaw - the same minting-not-draining failure class as Symbiosis two weeks ago. Roughly $2.3M in freshly minted tokens were sold into PancakeSwap, crashing MTR by almost 80% and MTRG by about 75%. The team said chain state was preserved but the recovery method was still undecided at week end. Meter was previously hacked for $4.4M in 2022 - also a bridge incident.

My take: The repeat-offender pattern now runs through the whole genre: bridges and validation layers fail twice because the first patch fixes the symptom. When a chain cannot yet say how it will unwind a mint, holders are pricing that indecision - and the 80% dump is what the price thinks of it.

5. FomoPeek iOS Wallet App Turned Out to Be Stealing Seed Data

Event date: Binance advisory and wider press September 21, 2026 (SlowMist/OKX disclosure September 19; malicious versions shipped September 9-17)

Source: SlowMist and OKX disclosure; Binance security advisory and TheStreet, September 21.

Summary: The FomoPeek iOS app shipped two malicious modules in versions 1.1-1.2, released September 9-17, that carried a kernel exploitation framework with eight attack methods to escape sandboxing and read Keychain data on iOS 12.0-18.7 and 26.0-26.1. SlowMist and OKX disclosed the finding on September 19, with stolen funds traced through FixedFloat and KuCoin, though neither firm published a full loss tally. The story widened into this week on September 21, when Binance urged anyone who had installed the app to treat every key and seed phrase on the device as exposed, generate new credentials on a clean phone, and move funds. Testing showed the payload could reach data belonging to other wallet and note apps, including Apple Notes - a common place users store seed phrases. Users of affected versions were told to assume recovery data was exposed and move funds to new wallets.

My take: The exchange and bridge incidents dominate the dollar totals, but this is the one that should change reader behaviour: official app stores, official apps, kernel-level theft. A seed phrase typed into any phone running a compromised app was never private.

Stablecoins and Payments: Banks Step In, Exchanges Pick Sides

6. SoFi Settles Its $25B Card Program in SoFiUSD Across Mastercard

Event date: September 22, 2026

Source: SoFi investor announcement (investors.sofi.com); SoFi official account; Mastercard network.

Summary: SoFi, the US fintech that now operates as a national bank, went live with stablecoin settlement across Mastercard's global payments network, using its own SoFiUSD dollar stablecoin as the backend settlement asset for card transactions. The company said it is migrating its full card program - annualized volume above $25B - to blockchain-based settlement, making it the first US national bank to run stablecoin settlement at card-network scale.

My take: The word that matters is backend. No consumer is being asked to hold a stablecoin; the dollar-token is invisible plumbing between the bank and the network. That is the adoption path that scales, because it asks nobody to change behaviour - it just changes what settles underneath.

7. Binance Buys $100M of Circle Equity and Signs a Five-Year USDC Deal

Event date: September 22, 2026 (private placement closed September 17; share-level detail reported September 26)

Source: Binance and Circle announcements; Blokfeed, September 24; Cointribune share-level reporting, September 26.

Summary: Binance acquired an equity stake in Circle - reported at about $100M, roughly 1.237M shares at $80.84 each - alongside a new five-year commercial agreement to promote USDC across its platform, with an explicit focus on emerging markets where USDT dominates. The deal replaces simple listing economics with revenue sharing tied to Circle wallet flows. It extends an earlier partnership under which USDC balances held on Binance jumped about 376% to roughly $7.1B.

My take: The stablecoin war has moved past token design to distribution: whoever controls the checkout controls the float. An exchange buying its issuer is the clearest signal yet that USDC's route to challenging USDT runs through platforms, not throughTreasury bills.

8. Circle's StableFX Goes Live on Arc Mainnet - and a USDC/USDC Pool Prints 489% APY

Event date: StableFX live on Arc during the week of September 21 (Arc mainnet launched September 16; briefing and pool coverage September 23)

Source: Circle product announcements; Digital Money Box briefing, September 23; market coverage of the Arc liquidity pool, September 23.

Summary: Circle launched StableFX, a 24/7 on-chain foreign exchange service, on its Arc mainnet - the USDC-gas chain whose launch we covered last week. In the same week, observers noticed a decentralised exchange pool on Arc pairing USDC against USDC, made possible by differences in how the chain's identification layer treats nominally identical tokens; arbitrage bots kept trading across it and paying its 1% fee, briefly printing annualized yields near 489% with, unusually, no impermanent loss - because the two sides are the same asset.

My take: The pool is a footnote, not a market - but it is a diagnostic footnote: two tokens with one ticker are two tokens. On a chain whose whole pitch is native USDC settlement, identity and denomination details are exactly the kind of thing that becomes a fee event.

9. Brazil's Crypto Volume Is 98% Stablecoins - the LatAm Pattern Hardens

Event date: September 23, 2026 (Q1 2026 data)

Source: Brazil central bank declared-volume data; regional aggregation via Cathy Coin / Financial Intelligence, September 23.

Summary: Brazil's declared crypto transaction volume for Q1 2026 came in at $6.9B, 98% of it in dollar-pegged tokens, under the central bank's virtual-asset rules in force since February 2 and alongside Pix instant-payment ubiquity. Argentina shows the same shape: about 11.2M crypto holders in 2025, USDT and USDC above 70% of purchases, and roughly 75% of workers paid in crypto choosing stablecoins. Region-wide, stablecoins carried 3% of LatAm cross-border remittances in 2023 and 11% by 2025, and process over 90% of the region's digital-asset volume.

My take: This is the demand side of everything else in this week's report: SoFi's backend settlement, TRON's $25B a day, Circle's emerging-markets push. Latin America is not adopting crypto; it is adopting the dollar, through rails that happen to be blockchains.

Regulation and Policy: Two Reserve Rules Under Fire at Once

10. ECB and Eurozone Central Banks Move to Scrap MiCA's 60% Bank-Deposit Rule

Event date: September 22, 2026

Source: CoinDesk via Reuters; ECB recommendation; Paolo Ardoino statement, September 22.

Summary: The ECB and the EU central-bank system recommended deleting MiCA's requirement that large stablecoin issuers hold 60% of reserves in commercial bank deposits, proposing liquid short-term assets as the safer alternative. The recommendation came to light the same day Tether CEO Paolo Ardoino reiterated that Tether had refused to apply for an EU MiCA license over that exact clause - a rule no major issuer has satisfied.

My take: When the central banks themselves conclude that parking stablecoin reserves in banks creates the run risk, the rule has failed on its own terms. Watch whether Brussels follows: a MiCA rewrite would reopen the EU market to the issuers that walked away.

11. Fed's GENIUS Act Rulemaking Puts a Two-Day Clock on Stablecoin Redemption

Event date: September 24, 2026 (proposals published; follow-up reporting September 26)

Source: Federal Reserve proposed rules, published September 24 (60-day comment period); Alpha Node morning wrap, September 26.

Summary: The Federal Reserve published two proposed rules implementing the GENIUS Act on September 24: a two-business-day redemption standard for Fed-supervised issuers, tiered capital charges (2% on the first $20B of stablecoins outstanding, 1.5% on the next $30B, 1% above $50B), and monthly audited reserve disclosures. If reserves fall below the required 1:1 backing, the issuer must notify the Fed and either restore reserves under a remediation plan or liquidate reserves and redeem all outstanding stablecoins. Critics note the liquidation path could force asset sales into a falling market precisely when reserves are stressed. The proposals carry a 60-day comment period, inside the broader GENIUS Act calendar that runs to January 18, 2027 or 120 days after final rules, whichever comes first.

My take: A two-day clock that ends in forced redemption converts a reserve dip into a selling event. Reserve composition - short T-bills versus bank deposits - now determines not just yield but tail risk. The ECB and the Fed are converging on the same lesson from opposite directions.

12. SEC's Crypto Mom Sets an Exit Date, and ARK Takes Its Fund On-Chain

Event date: September 25, 2026 (departure letter posted); September 23 (SEC order) and 24 (Securitize announcement) for ARK

Source: SEC commissioner announcements; ARK Invest and Securitize announcements; Alpha Node and Digital Money Box reporting.

Summary: Commissioner Hester Peirce, the SEC's steadiest crypto advocate, will leave the agency on October 2. In the same week, the SEC granted ARK Venture Fund amended exemptive relief covering tokenized and exchange-traded share classes, and ARK moved to bring its $1.3B venture fund on-chain through Securitize - tokenized interests on Ethereum with quarterly repurchase windows.

My take: Peirce leaving the week the first tokenized venture fund actually files is the regime in miniature: the work is moving from speeches inside the agency to filings against it. Whoever replaces her inherits a live pilot, not a blank page.

Markets and Flows: The Best ETF Week of 2026, Fading Daily

13. Bitcoin ETFs Log Their Best Week of the Year - With Inflows Shrinking Every Day

Event date: September 21-25, 2026

Source: SoSoValue flow data via The Unum and 24/7 Wall St.; CoinGlass.

Summary: US spot Bitcoin ETFs took in about $2.39B over five sessions - their largest weekly total since October 2025 and the best week of 2026. The catch is the shape: $998.95M on Monday declining daily to $134.47M on Friday, an 87% fade. BlackRock's IBIT led with $1.16B for the week, Fidelity's FBTC took $701.68M, ARKB $294.73M, and WisdomTree's BTCW was the only outflow at -$4.02M. Spot Ethereum ETFs added $689.88M with every day positive (ETHA $326.17M, FETH $174.02M), Solana products extended a streak to 12 weeks with $188.22M, and XRP ETFs took $75.59M. One tracker disagreement is worth flagging: FinanceFeeds reported September 25 as a -$253.4M Bitcoin-ETF day, while SoSoValue and CoinGlass both show the day net positive.

My take: A five-day streak is a demand signal; an 87% fade inside it is a caution label. Both are true, and the week's actual test - whether flows re-accelerate after the Bitget shock - lands next week.

14. Bitcoin Pushes Past $87,000, Then Spends the Week Settling at $84,000

Event date: September 21-27, 2026

Source: Exchange price data via CoinGlass and Coindoo; DefiLlama Coin price history.

Summary: Bitcoin started the week near $81,200 and jumped about 6.7% on Monday, September 21 - daily closes printed above $86,500, with intraday highs reported around $87,374 - then spent the rest of the week easing back, closing near $84,400, up roughly 4% on the week. Ethereum followed the same arc, from about $2,645 to an early-week print near $2,775, closing near $2,696. The pullback came with US spot ETF demand still positive every day, and BitMEX - the venue that popularized perpetual futures - shut its exchange operations on September 23 after an 11-year run, a closure announced back in July: trading and deposits stopped, withdrawals stay open.

My take: A 6.7% single-day jump that gives back half its gain in five sessions while ETF buyers stay positive reads as leverage finding its level, not demand leaving. The BitMEX wind-down is the quiet detail: the derivatives venue that defined the last cycle is now a wind-down table.

Infrastructure and Data: TRON's $30 Trillion, Solana's Fee Day

15. TRON Crosses $30 Trillion in Lifetime Settlement Volume

Event date: Announced September 23-24, 2026 (coverage dates differ; the GlobeNewswire release and Gate.io report September 23, Cryptonomist and CoinMarketCap September 24, from Geneva)

Source: TRON DAO announcement via GlobeNewswire; Token Terminal data cited therein; CoinDesk Research.

Summary: TRON DAO announced that total transaction volume settled on TRON since launch has surpassed $30 trillion. The network carries more than $94B of circulating USDT - the largest supply of any chain - with 405M accounts, 15B transactions and about $28B TVL. Token Terminal data in the announcement puts TRON first in year-to-date USDT transfer volume at roughly $6T, averaging about $25B per day; CoinDesk reporting separately cites about $150B of stablecoin transfers per week. The institutional bundling around the milestone: Canary Capital's staked-TRX ETF (TRXS), TRX futures on Bitnomial, Anchorage Digital adding native TRX staking and TRC-20 custody, the first Securitize-issued asset on TRON (Tokenized Hamilton Lane SCOPE Fund), and a top-5 protocol weight in the new S&P Pantera Digital Asset Index.

My take: The number to use in planning is not $30T lifetime - it is $25B a day, roughly $150B a week, on a rail where a USDT transfer costs well under a dollar. That is the settlement baseline every other rail in this report is now compared against.

16. Solana Out-Trades the NYSE and Out-Fees Ethereum in the Same Snapshot

Event date: September 22-23, 2026 (DEX data for the week ending September 13; fee snapshot September 22)

Source: Kobeissi Letter via exchange data; DefiLlama fee dashboard snapshot; Digital Money Box briefing, September 23.

Summary: Two Solana milestones landed in one briefing cycle. Weekly spot DEX trade counts on Solana reached 208M against the NYSE's 190M for the week ending September 13 - the first time an on-chain venue out-traded the floor in trade count. And a DefiLlama dashboard snapshot for September 22 showed Solana generating more user fees than Ethereum that day, though Ethereum kept its fee-burn lead. Solana ETF inflows, meanwhile, extended to a 12th consecutive week.

My take: Trade count is a flattering metric - the NYSE settles trillions in fewer, larger trades. The fee snapshot is the more interesting one: whichever chain absorbs more payment-sized activity will win the user-fee line, and payment-sized activity is precisely what the stablecoin data in this report tracks.

17. NYSE and Blockchain.com Sign MoU for Tokenized US Stocks

Event date: September 23, 2026

Source: NYSE and Blockchain.com memorandum; Blokfeed, September 24.

Summary: The NYSE and Blockchain.com signed a memorandum of understanding to explore offering tokenized US stocks and ETFs to Blockchain.com users, leaning on the SEC's five-year Innovation Exemption announced September 17. The plan contemplates near-instant settlement, fractional ownership and stablecoin funding, with market-data sharing between ICE and Blockchain.com and a potential reach of 44M accounts - all pending regulatory approval of the venue.

My take: The Innovation Exemption went from press release to first named counterparty in six days. Stablecoin-funded settlement of tokenized equities would put USDC in a role no securities rulebook anticipated - the approval path is the thing to watch, not the announcement.

18. FomoPeek's Frozen $318K Shows Both Halves of the Freeze Tool

Event date: September 27, 2026 (freeze reported)

Source: Circle and Tether actions; BlockchainReporter, September 27.

Summary: Follow-up on the Bitget breach: Circle and Tether froze a hacker-linked wallet holding roughly $318,000 in USDT and USDC combined - about 0.08% of the $387.5M moved to attacker addresses. Separately, on-chain analysts report the bulk of stolen funds moved to a wallet linked to market maker Wintermute, with neither a sale nor the purpose confirmed. The freeze demonstrates the issuer brake works exactly as designed; the arithmetic demonstrates how little it constrains an attacker who converts to non-freezable assets in the first six minutes.

My take: Both stablecoin camps will cite the freeze as the system working. It is - and it is also a 0.08% recovery rate on the stablecoin portion. The freeze tool is a brake, not a recovery mechanism; sizing exposure to exchanges remains the only real control.

What I'm Watching Next Week

1. Whether Bitget publishes its full forensic report, resumes withdrawals on the promised schedule, and executes compensation from the $464M protection fund.
2. Whether the Wintermute-linked wallet that received the bulk of the Bitget funds sells, returns, or holds - and whether the 5% recovery bounty produces results.
3. Whether the Fed's GENIUS Act proposal keeps its two-day redemption clock - remediation plan or full liquidation below par - intact through the 60-day comment period.
4. Whether Brussels acts on the ECB recommendation to delete MiCA's 60% bank-deposit rule - and whether Tether reopens an EU application if it does.
5. Whether Arc's StableFX produces public fee data for USDC-gas transfers, the standing comparison point against TRON's fee model.
6. Whether Symbiosis publishes its rewritten Bitcoin Bridge audit, whether Nostra reopens, and whether Liquid peg-outs resume - the three open items from the last two weeks.

Glossary