How 387 million dollars took a detour and vanished

Every week, Amdax summarizes what’s happening in the crypto market for you. Want to dive deeper? Click on the links (if available) in this article for more insights.

Market update

Stay informed in three steps:

1. Bitcoin gives back part of its recent rise
Bitcoin gave back around 5 percent from its September 21 peak, its highest level since January, and the broader altcoin space moved in step. The pressure appears to have come mainly from rates: the US ten-year yield rose on Monday to its highest level since 2007, in a week when oil prices climbed again and markets gave more weight to a second Fed rate hike in October. When US government bonds pay more, assets that pay no interest, such as gold and bitcoin, become relatively less attractive. Stocks gave up their September gains on Monday, and gold fell almost 4 percent that day, far more than bitcoin. Investors did keep buying through US bitcoin ETFs, which recorded their largest inflows of the year last week.

2. Europe moves toward US-style stablecoin rules
On September 24 the Fed proposed rules to implement the GENIUS Act, the US stablecoin law. Every stablecoin would need one-to-one backing by dollars, insured deposits or short-term Treasuries. Under the Fed’s proposal, a third party paying a return on stablecoins would be presumed to be prohibited interest. In Europe, the ECB and its national counterparts want to drop the MiCAR requirement that issuers hold at least 30 percent of their reserves as deposits. For large stablecoins, that rises to 60 percent. Instead, a set share of reserves would have to be available within one to five working days. Deposits tie stablecoins and credit institutions together, and in March 2023 that link briefly pushed USDC below one dollar when SVB collapsed. Like the Fed, they want to block returns through a side door: the ban on crypto service providers paying interest on stablecoins should extend to lending and staking.

3. Bitget hit by the largest crypto hack of 2026
On the evening of Thursday, September 24, Bitget saw 387.5 million dollars leave its wallets, while its cold wallets were unaffected. The attack did not go through the wallets themselves but through a security product from an outside supplier. It gave the attacker Bitget login credentials, which opened up the back-end system that controls the wallets. Transaction data was falsified there, which set off Bitget’s own approval process and sent the funds out. Bitget is using its protection fund of more than 464 million dollars to cover the damage, so customers do not lose any money. Lazarus, North Korea’s state-backed hacking group, is almost certainly behind the attack. Part of the stolen funds landed at addresses linked to the 2025 Bybit hack. Withdrawals have been reopening in stages since Monday.

Ries’ take

Shortly after the Bitget hack, blockchain investigators linked the stolen funds to the Bybit hack and, through it, to North Korea. But knowing who did it brings the money no closer to coming back. Foundations behind a few blockchains did freeze the attacker’s addresses, but part of the funds moved through DeFi protocols that are permissionless: anyone can use them and no one can stop a transaction. That property is one of the founding ideas of crypto: you can send money without an intermediary having to give permission or being able to block it. In a case like this, however, that same freedom works in the attacker’s favor, and stolen funds can no longer be stopped along the way.