The post Ledger Warns Users After Lost-Funds Reports appeared first on Coindoo.

The key part of Ledger’s warning is the 90-day guidance for recent buyers. A device that has never been set up should remain uninitialized, while users who already created a wallet may need to move assets to a new signer using a newly generated recovery phrase.

The 90-day warning turns on one question: has the wallet been created?

The difference between an unopened device and an active wallet explains Ledger’s two-part advice. A buyer who has not begun setup has not generated a recovery phrase through that device, so Ledger says not to initialize it. The company’s message to users who already set up a device is more involved because their wallet may already control assets.

Ledger advised those users to consider moving funds to a new Ledger signer with a new seed. The company has not publicly described the reason for that precaution, yet the wording shows that replacing the physical device alone would not address the concern.

A replacement device can still restore the old wallet

A hardware wallet does not hold cryptoassets in the same way a USB drive holds files. Assets remain on their respective blockchains, while the signer holds the private keys used to authorize transactions.

The 24-word recovery phrase can recreate those keys on another compatible device. Entering the existing phrase into a replacement Ledger therefore restores the same wallet, with the same addresses and the same security history.

Ledger’s guidance follows the same security principle seen in our report on affected Coldcard seeds: changing the hardware or installing updated software does not change the private keys created earlier. A secure migration requires fresh keys and a transfer to new addresses.

Users who choose to move funds should first create a fresh recovery phrase on the new signer, then transfer assets to receiving addresses generated from that phrase.

Ledger is investigating reports of loss of funds from users in South East Asia who purchased products from a reseller named CryptoBillis. As a precaution, and pending the results of our investigation, we have asked CryptoBilis to pause all sales and shipments of Ledger devices. We recommend Ledger users who purchased from this reseller in the last 90 days to not initiate set up if you have not done so yet. If you have set up your Ledger device, consider moving assets to a new Ledger signer (with new seed). We will continue to inform customers of updates as the investigation progresses.

Reach out to Ledger customer support through official channels with any questions: https://t.co/4p918UH8yb

— Ledger Support (@Ledger_Support) October 9, 2026

A cautious migration checklist for affected buyers

Ledger has not published a technical explanation for the reported losses, so users should follow its official updates and avoid improvising with recovery phrases. The practical goal is to create a fresh wallet environment before moving assets.

Security note: Ledger support will not ask for a recovery phrase. Anyone requesting the 24 words, a private key or remote access to a computer should be treated as a scammer.

What Ledger’s Genuine Check can verify

Ledger’s Genuine Check verifies the cryptographic identity of the device’s Secure Element. It remains an important authenticity check when a user sets up a Ledger from an authorized source.

Ledger also says the check cannot establish the full handling history of a device or detect every physical modification surrounding a genuine Secure Element. That limitation helps explain why a product can pass an important authenticity test while a company still investigates a possible problem in the wider sales process.

The $86 million estimate remains outside Ledger’s statement

Some crypto media outlets, including Crypto Briefing, have reported claims that losses connected to the incident may exceed $86 million. Ledger has not confirmed that figure, identified the affected wallet addresses, or explained the mechanism behind the reported thefts.

Without those details, outside estimates cannot establish how much of the reported on-chain activity belongs to the investigation Ledger announced.

The next Ledger update needs to answer three questions

Ledger’s investigation needs to establish whether the reports share a technical pattern, how buyers can identify affected purchases and whether customers who already created wallets need action beyond the company’s current guidance.

Until those answers arrive, the company’s warning gives recent buyers a practical security boundary: leave an unopened device uninitialized, never share a recovery phrase, and use a fresh seed when moving assets to another signer.

This article is for informational purposes only and does not constitute security, legal or investment advice. Users concerned that their device or recovery phrase may be compromised should follow Ledger’s official support guidance.

The post Ledger Warns Users After Lost-Funds Reports appeared first on Coindoo.

Check our Market Overview 

Source: https://coindoo.com/ledger-warns-users-after-lost-funds-reports/

The post Mastercard Joins XRP Ledger AI Payment Hackathon appeared first on Coindoo.

Mastercard is joining a builder weekend in New York

XRPL Commons lists Mastercard among the partners for its AI & Fintech XRPL Hackathon in Midtown Manhattan on October 24–25. Ripple, AWS, Ledger and Quicknode are also involved in the 36-hour event, which offers more than $40,000 in prizes and brings developers, product leads, designers and finance professionals together before Ripple’s Swell conference.

AI payments create a control problem before they create a payment product

The event’s agentic-finance track focuses on software that can pay, earn and transact on-chain. An AI agent could buy data, pay for computing capacity or settle a small invoice without a person approving every routine action.

Giving an agent the ability to pay also creates a control problem. A business needs to decide what it can spend, which recipients it can use and how an unsafe instruction can be stopped before money moves. XRPL’s developer tools already address part of that challenge by separating payment creation from the wallet authority needed to sign and submit a transaction.

Teams can use the weekend to turn those controls into working payment flows. A prototype may prove that an agent can pay for a service; a usable product must also show who approves the limits and how those limits are enforced.

Lending and protocol tools fill out the financial workflow

AI payments are only one part of the program. The lending-and-borrowing category invites teams to build around the proposed XRP Ledger Lending Protocol and Single Asset Vaults, while the protocol-innovation track covers amendments, client implementations and developer tools. A fourth open track leaves room for projects that do not fit the other categories.

A company using an automated payment tool may also need working capital, limits on collateral use and a way to verify that a counterparty is approved. That is why the event combines payments with lending, vaults and core protocol work instead of treating an on-chain transfer as the whole financial product.

READ MORE:

XRP Ledger Gives Banks New Wallet Controls

Mastercard’s stablecoin work gives the event a wider context

Mastercard has a separate reason to follow this work closely. In June, it announced expanded settlement options involving regulated stablecoins, including RLUSD. That announcement did not create the hackathon or commit Mastercard to any project built there, but it places the company’s event role within a wider effort to explore programmable settlement.

The real test begins after the judging ends

The hackathon can produce demos, prototypes and new developer connections. The first signs of lasting progress will come afterward: public code, teams that continue building, grants, pilots and follow-up support from Mastercard or the other partners.

That evidence will show whether the projects developed in New York can meet the security, compliance and user-control standards required beyond the crypto industry.

This article is for informational purposes only and does not constitute financial, investment or legal advice. Event partnerships and developer projects do not guarantee commercial deployment.

The post Mastercard Joins XRP Ledger AI Payment Hackathon appeared first on Coindoo.

Check our Market Overview 

Source: https://coindoo.com/mastercard-joins-xrp-ledger-ai-payment-hackathon/

The post Crypto’s Quantum Risk Begins With Wallet Keys, Says Europol appeared first on Coindoo.

Key Takeaways

Europol puts wallet keys at the centre of the risk

Europol published two reports on October 7 examining how quantum computing could affect cryptocurrencies and sensitive encrypted data. The agency separates the risk to wallet signatures from the wider question of blockchain integrity, directing attention to the cryptographic keys that authorise transfers.

Its European Cybercrime Centre report on quantum computing and cryptocurrencies identifies wallet keys as the main point of exposure. A sufficiently capable quantum computer could derive a private key from an exposed public key, potentially giving an attacker the authority needed to sign and broadcast a transaction.

The idea is easier to understand through the way a wallet works today. A public address lets other people send assets to a wallet and verify its transactions. The private key or recovery phrase gives the holder control over that wallet. Today’s computers cannot realistically work backwards from public transaction information and obtain the private key needed to sign a transfer. Europol’s concern is that quantum computing could eventually change that calculation.

The agency also draws an important line between wallet signatures and the rest of a blockchain. Europol says hash functions protecting important parts of blockchain integrity are comparatively more resistant to quantum attacks. Its warning therefore centres on the systems that prove ownership and authorise transfers, where a compromised key can immediately give someone control over assets.

A fuller explanation of the mechanics appears in our guide to how quantum computers could threaten crypto wallet security. The key point for readers is simple: Europol is focused on who can approve a transfer, not on a sudden collapse of every blockchain record.

Changing crypto security will take longer than a software update

Quantum hardware capable of carrying out this kind of attack has not reached the necessary scale. Europol says the timeline remains uncertain, yet it sees little value in waiting for a precise date. “Adapting systems and coordinating security upgrades will take time,” the agency wrote in its October 7 announcement.

The scale of the migration explains that urgency. Replacing a signature method affects far more than the underlying blockchain code. A secure transition depends on developers, validators, wallet makers, exchanges, custodians and users moving in a compatible order.

Europol calls this ability “crypto-agility.” It means having a safe route from an older security method to a stronger one without interrupting access to funds or leaving holders behind. That process needs to be designed well before a threat becomes urgent, especially on decentralised networks where no single company can force every participant to upgrade.

Current wallet crime shows why key control already matters

Quantum computing would create a new route to wallet control, but the crypto industry already deals with the same end result every day. Criminals use phishing, malware, impersonation, compromised platforms and physical coercion to obtain recovery phrases, private keys or access to accounts that can approve transfers.

Recent Chainalysis research estimated that $3.4 billion was stolen across crypto during 2025. The firm also identified roughly 158,000 individual wallet-compromise incidents affecting about 80,000 victims, involving an estimated $713 million in stolen value.

That research describes present-day theft, not quantum attacks. It still gives Europol’s warning practical context: private-key control already determines whether an attacker can move crypto assets. A future quantum-capable attack would seek the same authority through a weakness in public-key cryptography instead of a stolen seed phrase or a fraudulent support message.

Europol’s warning calls for long-term preparation while users and service providers continue to defend against the threats causing losses today. Quantum-resistant signatures would not eliminate phishing, exchange breaches, poor password practices or unsafe storage of recovery phrases.

READ MORE:

Ethereum Price Drops Below Its Trendline: Why $2,550 Support Matters

The second report looks beyond coins to data that must stay private

Wallet keys are one part of Europol’s warning. Its second report, Harvest Now, Decrypt Later, turns to information that attackers can collect today and attempt to decrypt later when more capable quantum computing becomes available.

The greatest concern involves information that must remain confidential for many years: government communications, intellectual property, medical records and identity data. An attacker does not need a quantum computer while collecting the material. They need storage capacity, an expectation that the information will remain valuable and the ability to wait for better computing tools.

For crypto companies, this risk sits alongside the assets they hold. Exchanges, custodians and wallet providers can store identity documents, account details, support messages, internal communications and transaction-related records outside the blockchain. The agency says there is no clear evidence that this approach is being systematically used at scale, but it still recommends reviewing the encryption and key-management systems that protect long-lived data.

That creates two separate preparation jobs. Networks and wallet providers need an eventual route to stronger transaction signatures. Companies holding customer records also need to examine whether their data can remain confidential over the full period in which it has value.

Preparation needs to be visible without creating panic

For users, the useful response starts with ordinary wallet security rather than a rushed move based on a future threat. A legitimate network or wallet migration would come through official releases, documented software updates and clear instructions from the service a person already uses.

Unsolicited messages claiming that a wallet needs an immediate “quantum-safe” upgrade deserve caution, particularly when they ask for a recovery phrase, private key or connection to an unfamiliar application. Scammers routinely use technical language and urgency to create opportunities for theft; quantum computing gives them another subject to exploit.

The clearest sign of progress will be practical work that users can inspect: published technical proposals, compatible wallet releases, independent reviews and migration guidance that does not demand blind trust. A promise that a product is “quantum-proof” offers far less value without those details.

Europol’s warning is an engineering deadline without a date

No one can say when quantum computers will be able to threaten wallet cryptography at scale. Europol’s argument does not depend on predicting that date. It rests on the time required to agree on stronger standards, test them on live networks and move users safely to new signing systems.

Crypto’s quantum challenge therefore begins with preparation, not with a sudden attack. Wallet keys sit at the centre because they determine who can move assets. Building a credible way to protect that authority before quantum hardware becomes capable will matter far more than guessing the year when the threat first becomes real.

This article is for informational purposes only and does not constitute cybersecurity, financial or investment advice. Quantum-computing capabilities, security standards and wallet software may change as research develops.

The post Crypto’s Quantum Risk Begins With Wallet Keys, Says Europol appeared first on Coindoo.

Check our Market Overview 

Source: https://coindoo.com/cryptos-quantum-risk-begins-with-wallet-keys-says-europol/

The post Tether Sued After USDT Freeze appeared first on Coindoo.

Key Takeaways

$2.76 million in USDT became inaccessible

Conduit Technology has filed suit against USDT issuer Tether in the U.S. District Court for the Southern District of New York. The cross-border payments company alleges that Tether froze roughly $2.76 million in USDT held in a wallet it used for treasury operations, leaving money needed for its business unable to move.

According to reporting on the complaint, Conduit says Brazilian police did not identify its treasury wallet as one that should be frozen. It is seeking access to the funds, a declaration that Tether lacked the authority to hold them and at least $2.76 million in damages. These are allegations from Conduit’s lawsuit; the court has not decided whether the freeze was justified.

The dispute matters because stablecoins are increasingly used for business payments rather than only trading. A company can hold a dollar-pegged token in its own wallet, yet still lose the ability to send it at the moment it needs to settle an invoice, pay a supplier or move working capital.

A visible balance can still be unusable

USDT can sit in a self-custody wallet, where the holder controls the private key needed to sign a transaction. That key still gives access to the wallet address. If Tether blacklists the address, however, the USDT token contract can reject a transfer before it is completed on the network.

The balance may remain visible on a block explorer, but the holder can be unable to send it, swap it or redeem it through ordinary routes. For a payments company, that can create a cash-management problem even though the token continues to trade close to one dollar.

Conduit is challenging a freeze, not a government seizure. The distinction affects what remains in the wallet and what the company is asking the court to address.

Tether’s terms show the power it says it can use

Tether’s published legal terms set out the powers it says it can exercise for users of its site, wallets and services. They allow Tether to suspend access, freeze tokens or blacklist an address when required by law, where it considers action prudent, or when it believes it faces legal or compliance risk.

The terms also refer to sanctions, anti-money-laundering obligations, suspected prohibited use and government proceedings. Such controls can help an issuer respond to theft, fraud, sanctions breaches or official requests. They also give the issuer a significant role when a dispute arises over funds held in a wallet.

Whether those terms applied to Conduit’s wallet, and whether they supported this specific freeze, are central questions for the case. The court may also examine the information Tether relied on, the relationship between the companies and the losses Conduit says followed from the restriction.

READ MORE:

S&P 500 Hits a Record Again – What History Says for Bitcoin

For payment companies, the risk is access – not the peg

Businesses often choose USDT because it can move across borders more quickly than conventional bank transfers and is designed to hold a dollar value. The Conduit case shows that keeping the peg is only one part of the calculation. Access to the token can matter just as much when the funds are being used for day-to-day operations.

That creates a different treasury question from the familiar risk of a token losing value. A company may need to consider the issuer’s compliance rules, its own customer checks, its exposure to restricted counterparties and whether it has alternative payment rails if a wallet is blocked.

The same gap matters in corporate accounting. A wallet can show that a company holds stablecoins, but the legal route to redeem them for cash may depend on its agreement with the issuer or an intermediary. Our look at why stablecoin cash treatment hinges on redemption rights explains why companies need to examine those terms rather than relying on a token’s dollar peg alone.

Conduit has yet to prove that the freeze lacked authority, and Tether may contest its allegations. Even before the case is resolved, it offers a useful reminder for stablecoin users: a dollar token can remain worth one dollar while still being unavailable for the payment it was meant to make.

This article is for informational purposes only and does not constitute legal, financial or investment advice. The allegations described are unproven and remain subject to court proceedings.

The post Tether Sued After USDT Freeze appeared first on Coindoo.

Check our Market Overview 

Source: https://coindoo.com/tether-sued-after-usdt-freeze/

The post Bitget Hacker Moves Millions in XRP as Freezing Fails appeared first on Coindoo.

Key Takeaways

The stolen XRP is no longer sitting where it first landed. A CoinDesk review of XRP Ledger records found that roughly 54 million XRP had left the five original accounts used to hold the Bitget haul by 12:41 UTC on September 26. Two accounts that began with 20 million XRP each had been reduced to about 23 and 55 XRP, while a third held roughly 5.8 million XRP.

About 49 million XRP, valued near $75 million at the time, remained in those first five accounts. That figure only counts the original holding accounts: funds that leave them can still be under the attacker’s control in newly created wallets. The on-chain question is whether the XRP reaches a service that can identify and stop the person controlling it.

To understand what the $83 million figure actually measures, it helps to separate the original theft from the later redistribution.

The five original wallets show only the first stage

Public blockchain records show that roughly 103 million XRP left two Bitget-linked XRPL accounts on September 24 and reached the address rwNhefsz1UQEusxhCvHip3RANinWi4CTck. Arkham has placed that address in its Bitget Hacker entity.

The amount was then split among five holding accounts. The split confirms where the XRP first went. It cannot, by itself, show whether each later address belongs to the same operator, a laundering intermediary or an exchange customer.

Calling every transfer a “cash-out” would overstate the evidence. A movement between attacker-controlled wallets does not create new selling pressure by itself. Selling becomes a more concrete risk when the route reaches a centralized exchange, OTC desk, instant-swap service or another gateway that can turn XRP into a different asset or fiat money.

Ripple cannot freeze a native XRP balance

The limitation is built into how the XRP Ledger treats its native asset. XRP is not an issued token and has no issuer that can blacklist an account. The XRPL documentation states that freeze features apply to issued tokens held through trust lines, not XRP itself.

Ripple, the XRPL Foundation and validators therefore have no built-in authority to mark these native-XRP accounts as frozen. A normal payment from an account that holds sufficient XRP remains valid under the ledger’s current rules.

Traceability is not control. The XRP Ledger makes the transfers public, yet that transparency does not give Ripple authority to seize or lock native XRP held in another account.

The contrast is visible in the stablecoin portion of the same breach. CoinDesk reported that Circle and Tether had frozen about $320,000 in USDC and USDT tied to the incident. Those assets include issuer-level blacklist controls. Native XRP does not.

The important intervention point is the exchange deposit

Once the XRP reaches an exchange-controlled address, the issue changes from protocol rules to custodial control. The exchange can connect a tagged XRP deposit to a customer account, stop withdrawals or trading, preserve records and respond to investigators.

This distinction is especially relevant on the XRP Ledger because large exchanges commonly use shared deposit wallets. A destination tag tells the exchange which internal customer account should receive a payment. The tag is not public proof of a person’s identity, but it creates a point where the platform can match an on-chain deposit with its own customer records.

A September 25 public-XRPL analysis traced one route from an original holding account through intermediary addresses toward Binance and MEXC deposit infrastructure. That does not prove those exchanges received or credited all later transfers, and neither platform should be described as having frozen funds without a public confirmation. It does show why on-chain alerts matter before a large balance reaches an exit.

READ MORE:

How Cosmos Hub Stopped and Restarted to Seize Stolen ATOM

The holding accounts are emptying quickly

That exchange checkpoint is becoming more urgent because the original holding accounts are emptying quickly. They held around 70 million XRP at 04:32 UTC on September 26. Roughly eight hours later, that balance was about 49 million XRP, according to CoinDesk’s review. In another visible detail, one account failed to send roughly 521,000 XRP because it did not have sufficient funds; a second account sent an identical amount to the intended recipient about an hour later.

That pattern supports the conclusion that the funds were being actively redistributed. It does not establish the reason for every transfer, whether a particular wallet belongs to a laundering service, or how much XRP has reached the market. Those require evidence beyond the ledger itself.

The decisive moment is not the next transfer between anonymous wallets. It is the first point at which a traceable XRP balance enters a service that knows who controls the account and can prevent it from leaving again.

This article is provided for informational purposes only and does not constitute financial, investment or legal advice. On-chain balances, wallet labels and exchange actions can change quickly as the investigation continues.

The post Bitget Hacker Moves Millions in XRP as Freezing Fails appeared first on Coindoo.

Check our Market Overview 

Source: https://coindoo.com/bitget-hacker-moves-millions-in-xrp-as-freezing-fails/

The post Bitget Wallets Flagged in Suspected $170M Security Breach appeared first on Coindoo.

The claim remains unconfirmed. Neither the reported attack method nor the final loss total had been established at publication. The Block said it had contacted Bitget to ask whether the transfers were tied to a security incident and whether withdrawals had been paused, but no public explanation had been identified at publication.

The alerts concern wallets associated with Bitget’s exchange infrastructure; they do not establish a compromise of the separately branded Bitget Wallet self-custody app.

What the on-chain trail reportedly shows

The Block reported also that on-chain data appeared to show more than $170 million moving from Bitget hot and cold wallets to one address over roughly an hour. The transfers reportedly included ETH, USDT, USDC, AVAX and BNB.

Wu Blockchain said, citing MLM monitoring, that three hot wallets and one cold wallet were suspected of being involved. It linked the activity to 0x770b10b273fC44Fe9197D6bF20F145c2e98463Ee and stressed that the attack vector and total losses remain unconfirmed.

Withdrawal Complaints Create a Separate Question

The Block also noted social-media posts and online reports from users who said they were experiencing withdrawal problems. Those claims do not establish that Bitget has suspended withdrawals, and they do not prove that any service issue is connected to the flagged wallet movements.

They nevertheless create a second question for the exchange. If the transfers were authorised wallet management, Bitget can identify the receiving address and explain whether users are facing an unrelated operational delay. If the two developments are connected, a public response becomes more urgent.

Why $170 million moved does not yet mean $170 million was stolen

Exchanges regularly shift large balances between hot wallets, cold storage and liquidity-related addresses. A large transfer can look alarming on a blockchain explorer while still being authorised wallet management.

The reported pattern here is more difficult to dismiss than a single transfer because assets from several wallets reportedly reached one fresh address that was not identified as Bitget-controlled and then entered swaps. Even so, that is evidence worth investigating, not proof of theft.

The missing fact is simple: does Bitget control the receiving address?

If the exchange identifies it as an internal operational wallet, the breach theory weakens sharply. If the ETH continues through bridges, mixers or wallets unrelated to Bitget, the case for an unauthorised outflow becomes much stronger.

Three answers matter more than the first loss estimate

Is the destination address controlled by Bitget?

This is the fastest way to separate internal wallet management from a possible compromise. The destination address is publicly visible; only Bitget can say whether it controls it.

Were the transfers authorised?

Bitget needs to clarify whether the wallets acted through normal signing procedures or whether access to any part of its infrastructure was compromised. Until then, claims about the method behind the transfers remain speculation.

Are users or platform services affected?

The on-chain reports do not establish that customer balances, deposits, withdrawals or trading services have been affected. A public update on those points would matter more to users than another revised estimate of the outflows.

What would settle the question

A formal Bitget statement is the next important development, but independent tracing will matter too. Security firms can follow whether the ETH remains in the recipient wallet, is moved through bridges, reaches exchange deposit addresses or enters recognised laundering routes.

That evidence will determine whether the story remains a suspicious sequence of wallet movements or becomes a confirmed exchange security incident. Until then, the $170 million figure should be treated as reported on-chain volume, not a final accounting of losses.

This article is provided for informational purposes only and does not constitute financial or investment advice. Wallet labels and on-chain estimates can change as new information emerges.

The post Bitget Wallets Flagged in Suspected $170M Security Breach appeared first on Coindoo.

Check our Market Overview 

Source: https://coindoo.com/bitget-wallets-flagged-in-suspected-170m-security-breach/

The post Bitget Breach: North Korea Link Probed, Withdrawals Paused appeared first on Coindoo.

Coindoo first covered the unusual wallet movements in its earlier report, when funds from Bitget-linked wallets were moving to a fresh address and being swapped on-chain. Bitget has since confirmed that the transfers were unauthorised.

How the Bitget Story Changed Overnight

The two dollar figures should not be read as competing estimates of the same thing. The $170 million number came from the initial visible on-chain flow. Bitget’s later $351.6 million figure is its internal estimate of the assets affected by the breach.

Bitget has not published a wallet-by-wallet reconciliation explaining the difference. What is clear is that the first alert captured only part of a wider incident that the exchange later confirmed from inside its own systems.

The North Korea Clue Is Not a Final Attribution

During a live security update, Bitget CEO Gracy Chen said some IP addresses associated with the attack matched VPN-use patterns linked to a North Korean hacker organisation. She also said the activity resembled previous attacks associated with North Korean operators, according to ChainCatcher’s report.

That is a preliminary lead, not a completed attribution. Bitget has not named a group or released the forensic evidence behind the assessment. The company’s current position is that North Korean involvement cannot be ruled out while investigators continue to trace the intrusion.

The Attack Did Not Require a Stolen Private Key

Bitget’s explanation changes the technical question around the breach.

In a September 25 update, Chen said the attacker compromised a critical backend system within the exchange’s wallet infrastructure. Bitget says the system was then used to create spoofed transfer data that reached its authorisation process and moved funds out.

Here is what we can confirm at this stage:

On the attack:
Our security team has made initial progress in tracing the source. The attacker compromised a critical backend system within our wallet infrastructure, used it to spoof transaction data, and triggered our authorization… https://t.co/5nINjwbXpC

— Gracy Chen @Bitget (@GracyBitget) September 25, 2026

The exchange says a private-key leak has been ruled out. It also says it has contained the incident and that no further unauthorised transfers are possible.

That does not make the breach less serious. It shifts the focus from key custody to the systems around it. If Bitget’s account is confirmed, the attacker did not need to possess a wallet key; it needed access to infrastructure capable of producing transfer information that the approval process accepted.

The full incident report therefore matters more than the early North Korea clue. It needs to explain how manipulated data entered the authorisation flow, what controls failed to stop it and what has changed before withdrawals resume.

A Protection Fund Can Cover Losses, Not Restore Access

Bitget says its cold wallets were not affected and that the $351.6 million loss falls within the coverage of its User Protection Fund, which it says holds more than $464 million. The exchange also says customer account balances remain accurate.

This is the practical distinction for users. The protection fund addresses whether Bitget says it can absorb the financial loss. It does not, by itself, restore confidence that the wallet systems are ready for normal withdrawals.

Deposits and trading remain available, according to Bitget’s official security notice. Withdrawals remain suspended while the exchange works on remediation and security hardening. Chen said Bitget would announce a restart schedule only once it can give a confirmed timeframe.

The Remaining Question Is Inside Bitget’s Systems

The initial $170 million alert asked whether the suspicious wallet movements were real. Bitget has now answered that part: it says the transfers were unauthorised and the total exposure was far higher.

The harder question remains. If private keys were not stolen, how did a compromised backend system generate transfer data that Bitget’s authorisation process accepted?

That answer—not another revised loss estimate—will show whether the exchange has addressed the weakness that allowed the breach in the first place.

This article is provided for informational purposes only and does not constitute financial or investment advice. Attribution and technical findings can change as Bitget and independent investigators release further evidence.

The post Bitget Breach: North Korea Link Probed, Withdrawals Paused appeared first on Coindoo.

Check our Market Overview 

Source: https://coindoo.com/bitget-breach-north-korea-link-probed-withdrawals-paused/

The post Binance Iran Scrutiny Tests Its Post-Settlement Controls appeared first on Coindoo.

The question is what Binance knew

US federal prosecutors are investigating whether Binance violated sanctions against Iran by failing to prevent certain trading activity, according to a Reuters report citing Bloomberg.

The Manhattan US Attorney’s Office is reportedly leading the inquiry, with the Justice Department’s criminal division also involved. Prosecutors are said to be examining whether Binance knowingly allowed the trading.

That is a higher threshold than establishing that Iran-linked funds reached the exchange. Investigators would need to determine what information Binance possessed, whether its systems generated warnings and how the company responded.

The Justice Department declined to comment to Reuters, while the Manhattan US Attorney’s Office could not immediately be reached. The report relies on unnamed sources, and no public charging document has been filed.

Binance made specific compliance promises in 2023

Binance pleaded guilty in November 2023 to violating the Bank Secrecy Act, failing to register as a money-transmitting business and breaching the International Emergency Economic Powers Act.

Under its Justice Department resolution, the exchange agreed to approximately $4.32 billion in forfeiture and penalties. It was also required to strengthen its anti-money-laundering and sanctions systems and retain an independent compliance monitor for three years.

A separate Treasury Department settlement imposed a five-year monitorship. The monitor received access to Binance’s books, records and systems and must report its findings to FinCEN, the Office of Foreign Assets Control and the Commodity Futures Trading Commission.

The earlier case already involved Iran. US authorities said Binance intentionally failed to stop its American customers from trading with users in sanctioned jurisdictions. Between January 2018 and May 2022, the exchange caused more than $898 million in trades between US users and people ordinarily resident in Iran, according to the Justice Department.

The latest scrutiny therefore matters most if it concerns conduct after the settlement. The issue would no longer be whether Binance once had inadequate controls—it admitted that. The issue would be whether the replacement controls performed differently.

No compliance program can guarantee that illicit funds will never reach a platform. Its effectiveness depends on whether suspicious activity is detected, investigated and stopped within a reasonable period.

The $61 million forfeiture case is relevant—but proves less than it may appear

The reported investigation emerged days after Manhattan prosecutors filed a separate civil action seeking approximately $61 million in cryptocurrency allegedly derived from black-market Iranian oil sales.

The Justice Department’s complaint alleges that two Hong Kong companies, Blessed Trust and Hexa Whale, used Binance accounts to move proceeds from Iranian oil transactions.

Prosecutors connected the companies to a group of crypto addresses that allegedly received and distributed more than $1.5 billion. Some funds were reportedly routed to businesses and addresses associated with Iran’s Islamic Revolutionary Guard Corps.

The complaint concerns activity extending through 2024 and 2025, after the Binance settlement. However, it seeks forfeiture of the assets and does not charge Binance with laundering the money.

The two developments may be connected, but no public source has established that the forfeiture complaint is the basis of the reported Binance inquiry. Treating them as one confirmed case would go beyond the available evidence.

An Iranian connection is only the first step

Several separate facts would need to be established before activity on Binance could become evidence of knowing corporate misconduct.

Iran is subject to broad US restrictions, but nationality, residency and inclusion on an OFAC sanctions list are not interchangeable. The legal analysis can depend on who controlled the account, the underlying transaction, the counterparties involved and whether the activity touched the US financial system.

Binance says it investigates and removes prohibited users

Binance told Reuters that it follows a zero-tolerance approach to sanctions violations, cooperates with law enforcement and works to remove bad actors.

The company has separately denied that it reduced cooperation with US crypto investigations, making its handling of alerts and law-enforcement requests part of the wider dispute.

Binance offered a similar defense after Reuters traced at least $676 million from addresses associated with the Dubai-based exchange Shelbit to its platform. The company said Shelbit itself did not hold a Binance account and had not been sanctioned. According to Binance, its compliance team investigated related users, froze their accounts and reported them to law enforcement.

READ MORE:

How Robinhood Chain’s 10M Daily Transactions Boost Arbitrum

The response describes what a working control system should eventually do. It leaves several questions unanswered:

The timeline will decide what this story becomes

The reported inquiry could end without charges, produce another enforcement action or lead to findings from Binance’s monitors. Until authorities disclose more, it cannot be treated as proof that the company breached its settlement obligations.

The most important evidence would show when Binance learned about the relevant customers and what happened next. A prompt investigation, account freeze and report to authorities could indicate that the post-settlement controls worked. Continued trading after clear internal warnings would suggest that the changes failed at the point where they mattered.

The presence of Iran-linked funds on Binance is therefore not the conclusion of the story. The decisive question is whether the exchange’s compliance machinery recognized the risk, and whether anyone chose to ignore it.

This article is provided for informational purposes only. A reported investigation does not establish wrongdoing, and allegations in civil complaints remain unproven unless established in court.

The post Binance Iran Scrutiny Tests Its Post-Settlement Controls appeared first on Coindoo.

Check our Market Overview 

Source: https://coindoo.com/binance-iran-scrutiny-tests-its-post-settlement-controls/

The post One Attacker, Multiple Tokens: Inside the Fetch.ai Breach appeared first on Coindoo.

Fetch.ai’s update changes the scope of the incident

Initial reports focused on approximately 8.7 million FET, worth around $1.5 million, removed from Fetch.ai’s TokenConversionManagerV3 contract on Ethereum.

Blockaid said the attacker presented a valid conversion-authorizer signature, allowing the contract to release its remaining FET balance. Fetch.ai has since published a preliminary onchain analysis tracing the attack path to a leaked signing key.

An on-chain analysis of the exploit is now available on ASI:One. It traces the attack from the compromised signing key to the attacker’s cash-out wallets. This is not the final analysis.

Read the report: https://t.co/W95r50VMaY

Together with @SingularityNET, we have deactivated…

— Fetch.ai (@Fetch_ai) September 20, 2026

The project said it worked with SingularityNET to deactivate the affected wallets and contracts. It also cautioned that the analysis is preliminary and that the investigation remains open.

The same wallet that received the FET was later linked to approximately 409 million NTX created through a NuNet deployer account. The tokens were valued near $460,000 when issued.

The incident widened again when PeckShield reported that the wallet was also connected to unauthorized mints of approximately 260 million AGIX and 54 million WMTX. The attacker’s holdings were valued near $17 million when the security firm’s findings were reported.

The shared wallet is why researchers have attributed the transactions to the same attacker. It does not yet show whether one leaked key provided access to every affected contract or whether several credentials were compromised.

The dollar totals hide two different kinds of damage

The FET and NTX incidents did not affect holders in the same way.

The FET transaction removed tokens that already existed. That created a known loss and gave the attacker assets that could be sold, but it did not directly increase the total number of FET tokens.

The reported NTX transaction reached the token’s issuance process. Instead of transferring a balance from one wallet to another, the deployer account apparently created tokens outside the expected distribution schedule.

CoinGecko lists a maximum supply of one billion NTX. The reported unauthorized mint was therefore equal to roughly 41% of that amount.

That does not mean every unauthorized token entered circulation. Data providers may also exclude tokens that NuNet later invalidates, burns or replaces through a contract migration. The comparison shows why traders could no longer rely on the displayed supply figure without further clarification from the project.

The later AGIX and WMTX findings make this distinction more important. The central question is no longer how much was removed from one contract, but how widely the compromised permissions could be used to create or release assets.

Why NTX fell much harder than FET

NTX fell roughly 70% after the incident became public and reached a new all-time low on September 20. FET declined by a much smaller percentage while the wider crypto market was also trading lower.

The timing and scale of the unauthorized mint provide a plausible explanation for the difference, although they do not prove that the incident caused every part of the NTX decline.

The reported mint was large relative to supply

Creating an amount equal to approximately 41% of the stated maximum supply introduced immediate dilution concerns. Traders also had no clear information about how many of the tokens could reach exchanges or decentralized liquidity pools.

NTX trades in a thin market

CoinGecko showed less than $50,000 in rolling 24-hour NTX volume when checked. The unauthorized tokens had been valued near $460,000 when created, making the reported mint roughly ten times larger than the token’s recent daily turnover.

The comparison does not measure how much the attacker sold. It illustrates the available market depth: attempting to sell even a fraction of such a position could move the price sharply when relatively few buyers are waiting nearby.

The market could not immediately verify that minting had stopped

A stolen balance has a measurable limit. An exposed minting permission creates a more open-ended risk because holders need evidence that the authority has been revoked before they can rule out further issuance.

A valid signature can still authorize an attack

A smart contract can verify that a signature came from an approved key, but it cannot determine whether the legitimate owner intended the transaction. Once the signing key was compromised, the attacker’s instruction could appear valid to the contract.

This is why describing the incident only as a smart-contract exploit would be incomplete. The code controlling the withdrawal and the security of the key authorizing it formed one system. A failure in either part could expose the assets.

SlowMist noted that Fetch.ai’s incoming conversion function relied on a single externally owned account signature and lacked some of the additional restrictions present in another conversion function. Fetch.ai’s final report will need to establish how that design interacted with the leaked key.

Blockchain transparency helps researchers follow the resulting transactions, but it does not prevent an approved credential from being misused. A similar limitation appeared in Polymarket’s reported $10 million fraud attempt: public records can expose what happened after an instruction was accepted, while the harder security problem is deciding who should have been permitted to issue it.

READ MORE:

Ethereum Jumps Above $2,600, Reaches Highest Price Since January

Deactivating the contracts contains the risk, but does not resolve it

Fetch.ai’s decision to deactivate affected wallets and contracts is an important containment step. Holders still need a final account of which permissions were exposed and how the affected tokens will be handled.

The permissions now matter more than the first loss estimate

The incident was initially described as an attack involving approximately $2 million. The later findings make that figure a poor measure of its potential reach.

The more important boundary is the authority the leaked credentials provided. Fetch.ai and the connected projects will need to show that the affected permissions have been removed and that unauthorized tokens cannot continue moving through recognized contracts.

Until that evidence is available, token prices will reflect more than the assets already taken. They will also carry uncertainty over which supply figures and contract permissions the market can still trust.

This article is provided for informational purposes only and does not constitute financial or investment advice. The investigation remains ongoing, and the reported figures may change as the affected projects and security researchers publish additional findings.

The post One Attacker, Multiple Tokens: Inside the Fetch.ai Breach appeared first on Coindoo.

Check our Market Overview 

Source: https://coindoo.com/one-attacker-multiple-tokens-inside-the-fetch-ai-breach/

The post US Plans BTC-e Notices for 300,000 Email Addresses appeared first on Coindoo.

The case has moved slowly since the 2017 seizure

BTC-e was taken offline in 2017 as US authorities pursued the exchange and people connected to its operation. The current civil forfeiture case concerns assets the government alleges were held in BTC-e operating wallets and connected to unlawful activity.

The additional emails are intended for addresses associated with accounts that showed positive balances when the servers were seized. The order does not say that every address remains active, belongs to a different person or corresponds to a valid claim.

The 300,000 figure measures notice, not ownership

The government’s list comes from BTC-e account records. It therefore measures the number of email addresses selected for outreach—not the number of verified customers, successful claimants or eventual recoveries.

One person may have controlled more than one account, some addresses may now be inactive and some records may not contain enough information to connect an account to its former owner. Other recipients may decide that the value involved does not justify entering a federal forfeiture proceeding.

The court also granted late-claim requests submitted by several specifically identified parties after the government withdrew its opposition. That ruling applies to those requests; it is not a general extension for every former BTC-e customer.

The government is trying to prevent a notice challenge

Judge Nichols declined to stop the additional notice round because Supplemental Rule G requires the government to make a reasonable effort to contact people who may claim an interest in property targeted for forfeiture.

That requirement affects more than former users. If the notice process is later found inadequate, a settlement or final judgment could face a challenge from someone who was entitled to notice but did not receive it. Sending emails to the wider account list reduces that risk before the court resolves ownership of the assets.

This is forfeiture, not a bankruptcy payout

BTC-e’s former customers are not automatically creditors waiting for an estate administrator to distribute funds. In a civil forfeiture case, the government asks the court to transfer specified property to the United States. A former user seeking part of that property generally must assert a legal interest and support it with evidence.

That means an old account balance is useful evidence, but it does not reserve a corresponding amount of cryptocurrency for its former owner. The court must still consider whether the person has standing, whether the documentation is credible and whether the claimed interest can be connected to the property in the case.

Recipients face two separate response routes

These are separate procedures, and filing one may not preserve rights under the other. Anyone who receives a notice should follow the dates and instructions in that document rather than relying solely on general deadline summaries.

A positive balance does not establish a claim by itself

FinCEN said in 2017 that BTC-e often collected little customer information beyond a username, password and email address. That history may make it harder to match some accounts with real-world identities nearly a decade later.

The forfeiture complaint concerns assets allegedly held in BTC-e’s operating wallets rather than property already separated into customer-specific accounts. Former users asserting legitimate balances may therefore need records such as account statements, deposit and withdrawal histories, transaction hashes, archived emails or proof that they controlled the relevant funding address.

The government’s allegations against BTC-e do not mean every customer participated in illegal activity. They do mean that a database entry alone may not answer who owns the seized property.

READ MORE:

CLARITY Vote and Fed Decision: Crypto Scenarios to Watch

Unexpected BTC-e emails should be verified carefully

A mass notice concerning old cryptocurrency balances is likely to attract impersonation attempts. Before opening attachments, submitting documents or following payment instructions, recipients should:

Neither a verified claim nor a remission petition requires someone to surrender the credentials controlling a cryptocurrency wallet.

Monthly reports should show how the notice round develops

The court ordered the government to file an initial progress report by September 15 and another report every 30 days until the additional notice process is complete. The contents of the first report were not available in the public sources reviewed for this article.

Those filings should provide the next measurable update: whether the emails have been sent, how quickly the government is working through the list and whether the expanded outreach brings more claims into the case.

Until those claims are reviewed, 300,000 describes the reach of the proposed notice, not the likely number of recoveries. The monthly filings will indicate whether the wider effort produces additional ownership claims or extends an already lengthy proceeding.

This article is provided for informational purposes only and does not constitute legal or financial advice. Deadlines and filing requirements may depend on the notice received and the circumstances of an individual claim.

The post US Plans BTC-e Notices for 300,000 Email Addresses appeared first on Coindoo.

Check our Market Overview 

Source: https://coindoo.com/us-plans-btc-e-notices-for-300000-email-addresses/