Bitget CEO Gracy Chen disclosed in a livestream that attackers exploited a vulnerability in a third-party security product to steal internal network credentials and forge withdrawal instructions to the wallet system, bypassing risk controls. Private keys were not leaked and cold wallets remained unaffected, with the vulnerability now patched and the incident fully contained. Approximately $388 million in assets were transferred out, and the attacker's addresses and on-chain tracking data have been made public. Chen said the loss will be covered entirely by the user protection fund, which will be replenished to at least $300 million within one week after the fund is drawn down.

Bitget has reopened BTC withdrawals as scheduled under its phased restoration plan following the security incident. ETH-related network withdrawals will resume on September 29 at 16:00 UTC+8, USDT-related networks on September 30, and other token withdrawals plus fiat and C2C services starting October 2. CEO Gracy Chen and Greater China head Xie Jiayin are hosting public livestreams to review the incident, provide updates, and answer user questions in real time.

Bitget Greater China head Xie Jiayin addressed the community in a livestream, describing the event as the platform's first security crisis in its eight-year history. The incident has been traced to a targeted supply-chain attack on third-party security software, where attackers exploited product vulnerabilities to obtain internal network credentials. Xie emphasized that private keys were not compromised and cold wallet assets were unaffected. Bitget has engaged security firms Mandiant and SlowMist for independent reviews and will comprehensively upgrade monitoring and management standards for third-party components.

On-chain monitoring by Lookonchain shows the attacker who stole $351.6 million from Bitget is actively converting ETH to BTC through THORChain. The cross-chain protocol has defended its position, stating it is a permissionless and neutral public product without censorship mechanisms. Security firm GoPlus has disputed this characterization, arguing THORChain's fund outflows require active validator signing through TSS threshold signatures, and has called for the protocol to block addresses linked to North Korean actors.

South Korea's Financial Services Commission is exploring a market-maker framework for virtual asset markets to enhance efficiency and stability, according to digital finance policy officer Yoo Young-jun. Current legislation under the Virtual Asset User Protection Act prohibits market-making, but the FSC intends to revisit the mechanism during the second phase of legislative development. Yoo also indicated that core exchange functions may shift from self-regulation to statutory oversight, governance rules for major shareholders and management could be strengthened, and the framework may eventually cover diversified business models, digital asset issuance and disclosure systems, and Korean won stablecoins.

South Korean virtual asset trading volume has fallen more than 50% over the past year, yet the top 10% of users now account for over 96% of total trading activity, according to data from the Financial Supervisory Service. Trading concentration ratios across major exchanges reached extreme levels: Upbit at 95.6%, Bithumb at 97.41%, Coinone at 99.2%, Digital X at 99.43%, and Gopax at 97.61%. The figures underscore a deepening concentration of market activity among a small cohort of high-volume traders even as overall participation contracts.

Circle is advancing its South Korea expansion with a new senior director of ecosystem growth based in the country, according to Digital Asset. The role will focus on developing market entry strategy, partnering with local financial and digital asset firms, tracking regulatory developments, and identifying USDC infrastructure opportunities. In a July market report, Circle indicated it prefers collaborating with local Korean won stablecoin issuers rather than directly issuing a won-denominated stablecoin, positioning itself as the dollar-stablecoin infrastructure layer for the Korean market.

MEXC issued a public response to allegations that a user lost approximately $340,000 after the exchange failed to revoke an attacker's API key during an account recovery process. The user claimed attackers used forged documents to change the registered email and reset security settings on September 25, creating an API key during the brief takeover. After MEXC confirmed the theft and helped recover the account, the API remained active, and roughly 27 minutes after the 24-hour withdrawal restriction lifted, assets including 322,110 USDT were drained. MEXC said it has completed an initial investigation, provided a solution, and established a dedicated team to handle the case and protect user rights.

China's Ministry of State Security published an article asserting that virtual currencies have become a significant tool for criminal activity, including money laundering, cyberattacks, and espionage. The ministry argued that the so-called anonymity of cryptocurrencies is fundamentally a false proposition, since blockchains retain complete transaction records enabling full-chain tracing. It emphasized that transaction histories leave traces, real identities are difficult to conceal, and private keys provide no guarantee of asset safety.

Japanese police arrested two suspects, 31-year-old Saki Okayama and 38-year-old Mitsuteru Minamisawa, for allegedly participating in a fraud ring that impersonated Osaka Prefectural Police to extract crypto assets from victims. The group falsely told a woman in her 40s that her bank card was linked to a massive 600 billion yen fraud and money laundering operation, demanding she prove her innocence. Known losses across cases tied to the two suspects total approximately 240 million yen ($1.53 million), with the group's base suspected to be in Cambodia and the ringleaders possibly Chinese nationals.

Beijing Shijingshan police intercepted a new type of cross-border telecom fraud, freezing 780,000 yuan in funds and returning them to the victim. A 53-year-old man accompanying his child abroad received calls from fraudsters impersonating domestic Chinese police, who fabricated money laundering allegations and pressured him to transfer funds. The money was funneled through accounts belonging to two other overseas Chinese students who were themselves victims of the same fraud ring, illustrating a pattern where victims are turned into money-laundering tools for the group. Police successfully intervened through patient persuasion to prevent larger losses.