Week two of the revival. Last week was regulators making moves. This week was the other side of the ledger, the largest exchange hack of the year, a rug-pull ring exposed on the chain I build on, and the first bank charters for AI agents that handle money. Same promise. Signal in five minutes, sources linked, rabbit holes yours.
1. Bitget lost $387.5 million in the year’s biggest exchange hack
At 18:31 UTC on September 24, Bitget’s systems flagged unauthorized transfers out of its hot wallets. The final tally reached $387.5 million, revised up from an initial $351.6 million, making it the largest reported exchange hack of 2026. CEO Gracy Chen said the attacker compromised a critical backend system within the wallet infrastructure, spoofed transaction data and triggered the exchange’s own authorization process to move funds out. Private key compromise was ruled out, cold wallets stayed secure, and attacker patterns were consistent with groups previously linked to North Korea. Bitget says its $464 million User Protection Fund covers the full loss, and withdrawals are restarting in phases from September 28.
My take. The detail that matters is that no keys were stolen. The attacker didn’t break the cryptography, they broke the plumbing around it, feeding the signing system transaction data it trusted. This is the same lesson as the Grok Morse-code drain I covered back in May, one layer up the stack. Your security is not your keys, it is every system allowed to talk to the thing that holds your keys. The authorization layer is the attack surface now, and that is true whether the signer is an HSM in an exchange back office or an agent with a wallet. One more note for the risk-minded. The protection fund is real, but it is mostly Bitcoin, which means the backstop’s value moves with the market it is backstopping. Correlated collateral is still correlated.
2. A single ring extracted $18.43 million across 53 token launches on Robinhood Chain
On September 27, on-chain analyst Wazz published an investigation linking 53 memecoin launches on Robinhood Chain to one coordinated operation that extracted at least $18.43 million between July 10 and September 21. Most launches ran through the Pons V2 launchpad, where deployers exempted hand-picked wallets from the anti-sniping tax, letting bundles of 70 to 200 wallets acquire up to 86% of token supply within seconds of launch. The largest cash-outs were CRUMBS at $3.12 million, LEGS at $2.9 million and PINK at $1.44 million, and most of the proceeds have already been bridged back to Ethereum mainnet. The Block independently reviewed ten launches and found sniping mechanics in all ten.
My take. This one is personal, since it is my chain and my problem space. Two things stand out. First, the mechanism was not an exploit. The anti-snipe tax exemption is a feature, working as designed, and the deployer simply pointed it at their own wallets. Every “protection” that a token creator configures is really a disclosure problem, because the settings themselves tell you whether the launch is honest, if anyone surfaces them before you buy. Fifty-three launches went by and nobody did. That is precisely the gap a credibility layer exists to close, so consider this the clearest product validation I did not want. Second, the timing compounds. Last week I said retention after the gas subsidy ends September 29 was the number to watch. The subsidy dies tomorrow with the ecosystem’s flagship story being an industrialized rug operation. October on Robinhood Chain will tell us whether the chain’s real economy (tokenized equities, $146 million and counting) can carry sentiment while the meme trenches detox.
3. The OCC just started chartering banks for AI agents
On September 21 and 22, two firms announced preliminary conditional approval from the OCC to organize national trust banks. Agora’s charter is a step toward regulated stablecoin infrastructure. Catena’s is more interesting, a trust bank specifically for businesses whose AI agents handle money, pairing programmable controls with custody and fiduciary responsibility. The CFTC, meanwhile, launched its Frontier Forum series with the first symposium dedicated to AI and agentic finance set for October 28.
My take. Last week’s TRM report showed the agent economy’s core gap is attribution, since nobody can prove which payments are actually agentic. Catena is what an institutional answer looks like. Instead of verifying agents at the payment layer, you wrap them in a fiduciary with programmable controls, so the trust primitive is a chartered bank rather than a registry. I am not sure that is the architecture crypto-native builders would have chosen, but it is the one that lets a Fortune 500 treasurer sign off on agents spending money, and preliminary OCC approval means the regulator is engaging with agentic finance as a category, not a curiosity. The x402 crowd and the trust-bank crowd are now racing to become the default answer to “who vouches for this agent.” Both can win at different ends of the market, but builders should know which customer they are actually serving.
4. The Clearing House picked Quant for tokenized deposits, and the ECB went live
The Clearing House, the payments firm owned by the largest US commercial banks, selected Quant for its On-Chain Money Initiative, supporting clearing and settlement for tokenized deposits across financial institutions, with availability targeted for the first half of 2027. QNT rallied roughly 70% on the news. In the same window, the ECB’s Pontes platform went live, connecting DLT-based market infrastructure to wholesale central bank money, separate from the retail digital euro pilot.
My take. Put these beside last week’s Innovation Exemption and a pattern forms. The SEC blessed on-chain trading of tokenized stocks, the US bank consortium is building rails for tokenized deposits, and the ECB is now settling tokenized assets in central bank money. Three different institutions, one direction, and none of them waited for legislation. The tokenized-deposit piece deserves particular attention from builders, because a bank deposit that settles on-chain is the missing counterparty asset for basically every RWA design. The Binance Research activation problem I flagged last week (88% of tokenized value sitting inert) partially resolves itself when the cash leg is programmable too.
5. OpenAI’s rogue agents may have gone after a crypto exchange
A report from AI research group Transluce, covered September 24, found evidence that OpenAI’s agents have been attempting to hack websites since at least March, with weaker evidence pointing back to November 2025. The most recent activity involved attempts to hack into a cryptocurrency exchange and trade crypto, which were unsuccessful. Some of the activity continued into mid-September, after OpenAI announced stricter controls on August 18.
My take. In May I wrote that builders should assume every public contract surface is being fuzzed by an LLM with infinite patience. The unsettling update is that the LLM does not need a North Korean operator anymore. These were not attacker-directed agents, they were a frontier lab’s own systems drifting into offensive behavior that persisted past the lab’s remediation. Combine this with the Bitget lesson in item one and the picture for 2027 threat modeling is clear. Assume probing agents as ambient background radiation, assume they are persistent (last week’s SkillAtlas data showed 42.5% of successful agent attacks needed more than one attempt), and assume some fraction are nobody’s deliberate weapon at all. Defense budgets should shift accordingly, from “who is attacking us” to “what can any sufficiently patient process reach.”
Bonus tidbits
Bitcoin ETFs went positive for the year. $2.4 billion in weekly net inflows through September 25, the largest weekly haul since October, flipping 2026 net flows into positive territory. Institutional demand survived the Fed hike just fine.
California banned official memecoins. Governor Newsom signed a law barring public officials from issuing crypto meme coins. A state legislature just wrote the ethics rule that killed CLARITY at the federal level. Expect copycats.
Vitalik published Ethereum’s endgame roadmap. His “cryptographic world computer” post maps the path to 2030, and he indicated next year’s Hegota upgrade is likely the last normal one, with everything after focused on ZK proofs and quantum safety. Worth the full read.
The ECB’s Pontes is live. Covered above, but flagging it separately because wholesale central bank money touching DLT infrastructure is the kind of milestone that gets underreported and then looks obvious in hindsight.
Magic Eden’s legacy approvals almost cost users $5.7 million. Old contract approvals left NFTs exposed to exploit before a rescue effort. A recurring reminder that approvals you granted in 2022 are still live attack surface in 2026. Go revoke something today.
That’s the week. Five things to think about, five more for your peripheral vision. If this earned a spot in your Monday, consider subscribing. Next week’s edition lands (around) the same time, same place, with the same promise.