Crypto Morning Brief: Bitget Resumes BTC Withdrawals As Scheduled, Strategy Adds 1,665 BTC Last Week

Author: TechFlow

Yesterday's Market Updates

Bitget Opens BTC Withdrawal Service as Scheduled

Bitget has opened phased withdrawal functions as scheduled, and currently supports BTC withdrawals.

According to the previously announced timeline, ETH-related networks will open withdrawals on September 29 at 16:00 (UTC+8), USDT-related networks will open withdrawals on September 30 at 16:00 (UTC+8); other token withdrawals, fiat services, and C2C services will resume gradually starting from October 2 at 16:00 (UTC+8).

Currently, Bitget CEO Gracy Chen and Greater China Head Xie Jiayin are conducting a public live stream to review and explain the security incident, share the latest progress, and answer users' questions in real time.

MEXC User Account Hacked, API Backdoor Leads to $340k Theft

According to a post by user @shuangfei8, their MEXC account was hacked on September 25 when attackers reset security settings and breached the account within 10 minutes using forged identification documents. Although MEXC subsequently froze the account and assisted in recovery, it failed to revoke the API created by the attacker during the takeover. At 04:12 on September 27, just 27 minutes after the 24-hour withdrawal restriction was lifted, the attacker used this lingering API to bypass Google Authenticator and email verification, withdrawing 322,110 USDT and 9,133,999 ONE (totaling approximately $340,000) across 6 transactions in full. The user has filed a formal claim with MEXC and attempted to report the incident to police, demanding the platform preserve logs, provide written responses regarding the security vulnerability, and return the stolen assets. Additionally, several recent reports indicate multiple MEXC users have received suspicious emails resembling "requests to reset security settings." MEXC users are advised to immediately check 【API Management】 for any unknown APIs.

Wintermute Establishes $126M Short Position on Hyperliquid, Primarily in ETH

According to Onchain Lens monitoring, market maker Wintermute currently holds a $126.25 million short position on the decentralized exchange Hyperliquid, primarily consisting of:

• ETH short: $46.92 million
• SOL short: $11.3 million
• HYPE short: $10.03 million

These short positions currently show an unrealized profit of approximately $963,600, while Wintermute's historical cumulative realized PnL on this platform stands at +$197.22 million.

Strategy Acquires 1,665 Bitcoin Last Week, Total Holdings Reach 847,666 BTC

Strategy disclosed the acquisition of 1,665 BTC last week, bringing its total holdings to 847,666, and repurchased $152 million worth of STRC stock.

Binance to Support SPCXB Airdrop to MARSCOIN Holders and QQQB Airdrop to NiuLai Holders

According to Binance's official announcement, Binance will support the SpaceX (SPCXB) airdrop to MarsCoin (MARSCOIN) holders, and the Invesco QQQ Trust (QQQB) airdrop to NiuLai holders.

Rewards are divided into two parts: on-chain airdrop rewards (tokens distributed directly by the project team) and platform rewards (Binance will allocate 30% of the MARSCOIN and NiuLai spot trading fees as additional rewards). Binance will take random snapshots of user positions daily, with only daily holdings exceeding 10,000 tokens counting as eligible positions. Snapshot coverage includes spot, margin, leverage, and flexible savings accounts. Eligible position calculations begin in September 2026, with the first distribution scheduled for early October 2026.

FF, SUI, KMNO, and Other Tokens Will See Large Token Unlocks This Week

This week will see large token unlocks for FF, SUI, KMNO, and others;

SIGN unlocks on September 28, valued at ~$1.53 million, accounting for 3.62% of circulating supply;

FF unlocks on September 30, valued at ~$10.09 million, accounting for 2.51% of circulating supply;

CARDS unlocks on September 30, valued at ~$11.66 million, accounting for 10.62% of circulating supply;

FLOCK unlocks on September 30, valued at ~$1.17 million, accounting for 3.41% of circulating supply;

KMNO unlocks on October 1, valued at ~$10.99 million, accounting for 2.81% of circulating supply;

ZORA unlocks on September 30, valued at ~$1.42 million, accounting for 3.03% of circulating supply;

GPS unlocks on October 1, valued at ~$2.06 million, accounting for 3.03% of circulating supply;

SUI unlocks on September 30, valued at ~$16.71 million, accounting for 0.32% of circulating supply;

EIGEN unlocks on October 1, valued at ~$10.04 million, accounting for 5.19% of circulating supply;

ENA unlocks on October 2, valued at ~$11.13 million, accounting for 0.45% of circulating supply;

NVIDIA Launches Open Agent Safety Platform to Strengthen Full-Stack AI Governance and Control

NVIDIA has officially announced the launch of the Open Agent Safety Platform, designed to ensure the security and compliance of AI agents throughout the entire process from testing to actual deployment, enabling full-stack governance for software, hardware, computing, and robotics systems.

The platform mainly consists of two core components:

1. OpenShell open-source software: Establishes security boundaries during software runtime, tracks agent operations, and enforces preset policies. It is optimized for proprietary artificial intelligence CPUs (Vera CPU) while supporting third-party computing platforms;
2. NVIDIA Sentry reference system design: Runs out-of-band monitors relying on data processors (BlueField-4 DPU) to provide chip-level secure execution mechanisms, capable of isolating and blocking non-compliant boundary-crossing agents within milliseconds.

Currently, over 100 companies and institutions, including Anthropic, Microsoft, Salesforce, Cisco, and SpaceX AI, have partnered with NVIDIA to integrate this platform into their infrastructure, development tools, and enterprise workflows.

ZachXBT: Ties Suspected of Helping North Korean Hackers Launder Money Are Transferring Stolen Bitget Funds and Publicly Seeking Technical Support

On-chain investigator ZachXBT revealed that individuals suspected of assisting North Korean hacker groups with money laundering are currently publicly seeking order processing support on Discord public servers and Telegram channels of relevant service platforms. These laundered funds originate from the $387 million security breach incident at Bitget.

Investigations reveal that one individual codenamed "Alias 4" had previously participated in laundering the $292 million lost in the attack on Kelp DAO earlier this year. Currently, the funds are being jumped across multiple chains via cross-chain bridges and deposited into mixer platforms such as Wasabi. ZachXBT stated that this laundering pattern closely matches attack methods previously attributed to the TraderTraitor hacker group. He has been closely monitoring these syndicates and plans to release more tracking data in the coming weeks.

Citi and Coinbase Partner to Offer Stablecoin Payment Services for Institutional Clients

According to the Wall Street Journal, Citigroup has announced a partnership with Coinbase to provide stablecoin payment services for institutional clients. Coinbase will supply the stablecoin payment gateway and underlying blockchain technology, automatically converting stablecoins into fiat currency, while Citi acts as the ledger bank to complete fund settlement. Meanwhile, Coinbase payment customers can leverage Citi's banking capabilities to receive, hold, and make payments through bank-like account tools. Received cash will automatically convert into stablecoins and be stored in Coinbase, currently offering an annualized interest-like reward of 3.75%.

Today's Market Overview

Recommended Reading

Podcast Notes | The Sharpest Conversation Since CZ's Release: Addressing Blames for Last Year's October Crash and Confronting Hyperliquid Competition

https://www.techflowpost.com/article/34265

In his latest lengthy interview since release, CZ primarily addressed controversies surrounding FTX, last year's "10/10" crash, and competition from Hyperliquid. CZ attributes the FTX collapse to the misappropriation of client funds, and states the 10/10 crash was primarily triggered by tariffs and broader market sell-offs, not led by Binance. He also expressed welcome toward competition from DEXs like Hyperliquid, noting that global crypto adoption remains below 1%. After stepping back from frontline Binance operations, he has devoted more attention to crypto regulation and Giggle Academy, which has reached approximately 1.3 million children to date.

The Inside Story of the MEXC User's $340k Theft: Deepfake Breaks Through KYC, Exchange's Security Oversight Revealed

https://www.techflowpost.com/article/34263

AI deepfakes are increasingly breaching crypto exchange KYC processes, leaving one MEXC user with a ~$340,000 loss: Attackers used AI-generated handheld videos to impersonate the user, bypass KYC to change the email and phone number, and created an API with withdrawal permissions. Although MEXC later froze and restored the account, it overlooked this API, and just 27 minutes after the withdrawal cooldown ended, all assets were drained. The article argues that the real risk has extended from "AI face swapping" to the final mile of exchange security protocols. While KYC can prevent human impersonation, it may not stop AI impersonation, and API keys could become overlooked backdoors.

QNT Surges 300% in One Week: Which Assets Worth Watching in the Bank Tokenized Deposits Sector?

https://www.techflowpost.com/article/34254

Bank tokenized deposits are emerging as a new RWA sector: QNT surged approximately 300% in a week, driven by Quant being selected by US clearing institution TCH as the tech provider for its on-chain currency program, and UK banks successfully completing real tokenized GBP deposit payments via Quant. The article suggests that compared to stablecoins, banks prefer to move existing deposits "on-chain" rather than letting funds leave the banking system. Therefore, alongside QNT, investors should watch assets related to Canton's CC, Chainlink's LINK, and infrastructure like XRP/XLM.

UBS Research Interpretation: Micron Expected to Hit $52.4B Revenue in FQ4, Buyback Restrictions Lifted in December

https://www.techflowpost.com/article/34258

UBS remains bullish on Micron's AI storage cycle: forecasting FQ4 revenue of $52.4 billion and an 87.6% gross margin. The DRAM supply-demand deficit is expected to last at least until 2028, with server DDR demand projected to grow by ~80%. Meanwhile, restrictions on Micron's stock buybacks will be lifted on December 9. UBS anticipates buybacks to commence in early 2027, with quarterly scales potentially ramping rapidly from $20 billion to $40–50 billion. Overall, market focus has shifted from "whether the cycle is peaking" to "how long AI storage's robust performance can sustain."