🚨 CUSTODY
$XRP $ETH
They did not steal the keys.
Bitget now puts $387.5 million at attacker addresses after 18:31 UTC on 24 Sep. Largest theft of 2026 so far. The firm says the backend spoofed transfer data and the exchange’s own authorization signed the withdrawals. Cold wallets, they say, still stand.
The protection fund is larger than the hole. User balances are whole. Bitcoin withdrawals wait until Monday. The rest wait longer.
Turns out the old concern was never the vault door. It was one firm signing other people’s money because a backend looked legitimate.
A DEX is what replaces that signature.
@lookonchain A reserve ratio is a photograph of coins at rest.
An authorization path is the door those coins walk through.
Keys were still in the building. $387.5M left anyway.
@TedPillows $78k / $88k is leverage.
$387.5M left an exchange and Bitcoin closed the session flat. The sheet did not flip.
Parked ETH is the later inventory. That’s an ether print, not this magnet.
As of 27 Sep 00:09 +07 the airrates rates table does not show a Bitget-loot dump regime on BTC, ETH, or XRP. ETH and XRP majors still have longs paying.
https://t.co/tRpv1lAf5t, live 26–27 Sep: BTC OI $38.7B; ETH $25.7B, HL/Bitget +10.9%; XRP $2.6B +10.9% cluster. Homepage paid table replayed 2026-09-25.
https://t.co/nfIPh6QnkS
https://t.co/N69xBzkwfm
FALSIFIED IF — by 29 Sep 12:00 UTC, ETH or XRP major-venue funding on airrates flips and stays negative while the parked ETH wallets start spending.
🚨 CUSTODY
$XRP $ETH
They did not steal the keys.
Bitget now puts $387.5 million at attacker addresses after 18:31 UTC on 24 Sep. Largest theft of 2026 so far. The firm says the backend spoofed transfer data and the exchange’s own authorization signed the withdrawals. Cold wallets, they say, still stand.
The protection fund is larger than the hole. User balances are whole. Bitcoin withdrawals wait until Monday. The rest wait longer.
Turns out the old concern was never the vault door. It was one firm signing other people’s money because a backend looked legitimate.
A DEX is what replaces that signature.
Looks inside. That’s the false positive.
The chain shows Bitget’s own authorization signed $387.5 million out. That stamp is real. A named employee is not.
Insider stays the low-probability door Chen left open. It is not the story until someone with a badge or a report writes the name.
The story is still the signature. A DEX is what retires it.
@bitget $387.5M and the keys stayed in the building.
The backend spoofed the transfer. The exchange signed it. Balances are whole. Withdrawals are not — BTC Monday, the rest through 2 Oct.
Solvency and access are two different promises. Only one of them has a dollar amount on it.
Concede the part that’s straight. The fund covers the loss on paper. Trading and deposits never stopped. Bitget Wallet, the self-custodial app, sits on separate rails and was not in the blast.
What the fund does not buy back is the queue:
28 Sep 08:00 UTC — BTC
29 Sep — ETH (Ethereum, BSC, Arbitrum, Base, Optimism)
30 Sep — USDT
2 Oct — other tokens, fiat, P2P
Holding other people’s coins is still the biggest risk in this market. Insurance is a sequel. Custody is the first reel.
Watch the 28 Sep AMA and whether Monday’s Bitcoin line actually opens. If the dates slip, the story is no longer the hack. It’s the days.
Bitget’s 24 Sep drain is the largest publicly reported crypto theft of 2026 so far, and it ran through the approval layer, not stolen private keys.
Bitget 25 Sep update ($387.5M; Zcash + TRON added, not a second attack); Gracy Chen 25 Sep (backend spoof, private-key compromise ruled out); FT 25 Sep (“largest… so far this year”)
https://t.co/pdq8ED1siG
https://t.co/fojDTeSASi
false if by Friday 2 Oct close, Bitget or a primary investigator publishes that private keys were taken, or a larger 2026 theft prints above $387.5M.
Here is what we can confirm at this stage:
On the attack:
Our security team has made initial progress in tracing the source. The attacker compromised a critical backend system within our wallet infrastructure, used it to spoof transaction data, and triggered our authorization process to move funds out. Private key compromise has been ruled out — this excludes the more severe risk scenarios. Loss containment is confirmed. No further unauthorized transfers are possible. The specific method of system intrusion remains under active investigation. A full technical report will follow once confirmed.
On withdrawal restoration:
Multiple technical teams are working in parallel on system remediation and security hardening. Withdrawal restoration is being prepared in parallel. We will announce a timeline as soon as one is confirmed — we will not commit to a window we cannot guarantee.
@TedPillows You found the right book.
The $85M is the notional. The fuse is $2,519 — ETH 25x cross, about 4.6% under the mark on your card. BTC’s $73.6k has twice that air.
Same margin bucket. If $2,519 tags, it isn’t just the ETH line.
If it prints, that’s the next card.
@CoinMull Keep the hunt. The $80k stack is real.
One split: $3.2B is where longs would die. Last window on airrates (7 venues, no HL): BTC only printed $93M — 93% shorts, mark 81,437. The $2.9B funeral was B2.
If 80 tags, the print is the next card. I’ll watch the same tape.
The chill is right. Highest since Oct 10 is not the high that flushed.
That tape started near $207B and printed $19B of liquidations in a day. This five-venue stack is ~$65B. Same slope. Different mass. airrates, not Coinglass. 20 Sep 17:43 UTC.
7-venue liquidation tape (no Hyperliquid): $2.9B in the window. $2.2B of it was B2 shorts on Binance. BTC force-closes on that feed: $93M, 93% shorts. Binance took $83M of the BTC tape. Mark ~81,437.
Venue books now — Binance $32.8B OI (BTCUSDT $8.8B). Hyperliquid $12.7B (BTC $3.6B).
The rebuild is in the books. Tonight’s flush on this sheet is shorts, and it is not BTC.
https://t.co/Mvu0e0cBpC
This is the shape. Claude does not become Jev.
Jev sits in front and picks the model so the writer only runs when the snap isn’t enough. Vercel saw 5–18× on that classifier step after swapping Luna for Jev — not 200× on the whole agent.
The loop only gets faster by the share of switches you stop sending to a novelist. The cache note is the adult part. The novelist stays.
Friends, not a molt.
Astra keeps the paragraph. Jev takes the yes/no you were paying 2–20 seconds for. Vercel saw 5–18× on that step after they swapped a Luna classifier for Jev — not 200× on the whole agent.
The loop only gets faster by the share of snaps you stop sending to a novelist. The novelist stays.
🧠 #JEV
They named a mute model after Jevons.
When steam got cheaper, Britain burned more coal. A judgment at $0.042 per million tokens does not stay rare. You put a door on every step.
That’s the part of Jev nobody is posting. Not the latency. Not “zero hallucinations.” The name on the box is a demand explosion for snaps — some of them wrong, all of them in-schema.
BERT already knew how to shut up. The chat models never learned. This one was trained to stay quiet on purpose.
A 0.50 is still a coin. The schema cannot save you from that.
When the engine got efficient they did not burn less. They built more engines.
Ask it ten thousand times and you will meet the wrong in-schema answer. That’s Jevons. That’s the crush.