Multiple crypto security incidents emerge
The latest 24-hour period brought several major security developments across centralized exchanges, Layer 2 infrastructure and NFT contracts.
Bitget reported a loss of more than $387 million from its exchange hot wallets, while Payy Network said an exploit drained approximately $1.8 million in USDC from its Ethereum Layer 1 bridge contract. Separately, a vulnerability affecting Limit Break's NFT marketplace settlement contracts allowed an attacker to take 660 WETH and multiple NFTs before a white hat operation rescued more than 23,000 NFTs.
The incidents highlight the different types of risks that can affect crypto infrastructure. Centralized exchanges face risks around wallet and backend systems, while bridges and smart contracts can expose funds through vulnerabilities in transaction verification or contract logic.
At the same time, the period included developments on the defensive and infrastructure side, including Aave V4's support for Coinbase Tokenized Stocks on Base and progress on Ethereum client and consensus research.
Bitget reports $387 million hot-wallet breach
Bitget said its exchange hot wallets were compromised at 18:31 UTC on September 24, 2026, resulting in losses exceeding $387 million across Ethereum, EVM-compatible networks, XRP, Zcash and TRON. The exchange said its cold wallets remained secure.
Bitget also stated that affected users would be compensated through its $464 million User Protection Fund. The exchange suspended withdrawals while working with cybersecurity partners to investigate the incident. Its official incident announcement provides the exchange's account of the breach.
According to the supplied report, investigators linked the attacker to the North Korean Lazarus Group. The report says the attacker compromised a backend system, manipulated transfer information and subsequently obtained approval for transfers out of the exchange. That attribution remains a reported assessment rather than a fact independently established in the supplied material.
Bitget also introduced a Recovery Bounty Program, offering 5% of recovered or frozen assets to contributors who help recover funds.
Limit Break exploit drains WETH and NFTs
Another incident affected Limit Break's Payment Processor V2, an NFT marketplace settlement contract that was used by Magic Eden for EVM-based NFT trading in 2024.
According to the supplied report, an attacker exploited a vulnerability and obtained 660 WETH, along with 10 Meebits, 50 Otherdeeds and 10 WoW NFTs, among other assets. The same report says the issue also affected Limit Break's Payment Processor V3 on Ethereum mainnet and ApeChain, with the affected system paused.
Blockchain security researcher Quit, a vice president of blockchain at Yuga Labs, subsequently carried out an overnight white hat operation that rescued more than 23,000 NFTs, with an estimated value of approximately $5.7 million. The operation was intended to protect assets that could potentially have been taken through the vulnerable contracts.
The supplied report advises affected users to revoke token approvals for both the V2 and V3 contracts. Users whose NFTs were rescued can subsequently reclaim them through the claim portal created by Quit. The original security report can be reviewed through Quit's incident analysis.
Payy bridge exploit drains about $1.8 million
Payy Network, a privacy-focused Ethereum Layer 2, also reported an exploit involving its Ethereum Layer 1 bridge contract.
The incident resulted in the loss of the bridge's entire contract balance, including non-custodial user deposits held on the network and in Payy Wallet. The reported loss is approximately 1.8 million USDC.
Payy responded by pausing deposits, withdrawals, transfers and card transactions while investigating the incident. The project's incident statement says the exploit did not involve a compromised private key, social engineering or Payy's off-chain infrastructure.
The reported attack instead involved the injection of a fake burn message into the rollup's proven public inputs. According to the supplied account, this effectively forged a withdrawal while still appearing inside an otherwise normally verified transaction batch. The batch used Payy's prover path and validator signatures.
The distinction is important because it points to a potential weakness in the bridge's verification assumptions rather than a traditional wallet-key compromise.
Aave adds Coinbase tokenized stocks on Base
Not all of the day's developments involved exploits. Aave V4 added support for Coinbase Tokenized Stocks as collateral on its Base market.
Users can deposit AAPLc, AMZNc, GOOGLc, METAc, MSFTc, NVDAc and TSLAc as collateral and borrow USDC. Aave says the market uses Chainlink's 24/5 tokenized-equity feeds for pricing, incorporating both the underlying market price and a corporate-action multiplier.
Aave's official announcement confirms that the seven tokenized equities are collateral-only at launch and that USDC is the borrowable asset. The market operates through a dedicated Equities Hub on Base. The underlying shares are held in segregated custody, while the onchain tokens represent the corresponding economic exposure.
The integration connects traditional equity exposure with an established DeFi lending system. Aave's broader V4 architecture uses Hub and Spoke markets to separate liquidity and risk parameters across different asset groups.
Ethereum and wider DeFi developments
The security incidents were accompanied by several other developments across Ethereum and DeFi.
The supplied roundup points to ongoing work on decoupled Ethereum consensus, a proposed formally verified consensus design targeting faster finality, and progress on Ethereum trace interoperability, with 42 merged pull requests across clients and specifications.
Other developments mentioned include Aerodrome expanding to Base, Arbitrum, OP, Ink and Robinhood Chain, the announcement of the JUMP token sale by Jumper, and the launch of a post-quantum testnet. Fairblock also released confidential payment links, while a Balancer governance vote entered its voting window.
The roundup additionally notes new U.S. regulatory developments, including SEC staff FAQs concerning token buybacks and liquid staking tokens (LSTs) and the reported resignation of SEC Commissioner Hester Peirce, effective October 2. Independent reporting also places her resignation date on October 2, 2026.
What the incidents show about crypto security
The incidents span very different layers of the crypto ecosystem. Bitget's reported breach involved centralized exchange hot-wallet infrastructure, while Payy's incident centered on an Ethereum bridge contract and its rollup verification process. The Limit Break incident involved NFT marketplace settlement contracts and token approvals.
That variety means there is no single security model covering all crypto applications. Users interact with exchanges, bridges, smart contracts, wallets and tokenized assets, each with different technical assumptions and potential failure points.
The white hat rescue of more than 23,000 NFTs also demonstrates how quickly security researchers can sometimes intervene after a vulnerability becomes exploitable. However, the episode involving Limit Break also reinforces the importance of reviewing token approvals and contract permissions when a protocol announces a security incident.
Meanwhile, Aave's expansion into tokenized equities shows that financial assets are continuing to move deeper into DeFi infrastructure. Aave's own research describes V4 as an architecture designed to support new asset types while separating liquidity and risk across different markets.
For users and developers, the latest incidents make contract permissions, bridge verification, exchange wallet security and incident-response procedures important areas to monitor as more financial activity moves onchain.
