COINOTAG - FASTEST CRYPTO NEWS

• Bitget offers 5% rewards for freezing and 5% for recovering stolen funds.
• Bitget raised its hack-loss estimate to $387.5 million from $351.6 million.
• Circle froze 99,990 USDC and Tether froze 218,023 USDT tied to the attack.
5% Bounty for Frozen Funds
Bitget has opened a two-tier recovery bounty that pays 5% of affected funds for helping freeze stolen assets and a further 5% for helping recover them, as the exchange's own tracing lifted the value moved to attacker-controlled addresses to roughly $387.5 million. Chief Executive Gracy Chen announced the program on X on Sept. 26, urging exchanges, security researchers and on-chain investigators to join the hunt for the outflows, and publicly thanked Circle and Tether for moving quickly on freezes. Under the exchange's published program terms, the two rewards cover distinct outcomes: an eligible participant earns 5% on funds they directly help freeze and another 5% on funds they directly help recover, and voluntary freezes already completed can qualify alongside future efforts. Bitget alone decides who qualifies, how each contribution is measured and what gets paid, while actions taken under court orders or law-enforcement requests are excluded.
The revised total, a sum larger than the market cap of dozens of mid-tier tokens, sits about $35.9 million above Bitget's initial $351.6 million estimate. The company attributes the increase to a fuller accounting that now includes affected assets on Zcash and TRON, which were absent from the first calculation — not to any fresh unauthorized transfers. Circle has frozen 99,990 USDC and Tether 218,023 USDT at addresses tied to the incident, a combined total near $318,000 that effectively removes those dollar-linked tokens from active circulating supply. Bitget says other affected assets have also been frozen through industry partnerships without disclosing an aggregate figure. The bounty push followed scrutiny of USDC flows during the attack, after security researcher Taylor Monahan described stolen USDC moving through intermediate wallets with portions converted into ETH. A live tracing dashboard lists four primary receiving addresses — one each for EVM networks, the XRP Ledger, Zcash and TRON — and the exchange says Bybit's LazarusBounty initiative will serve as an additional channel, with stablecoin issuers, bridges and custodians asked to monitor the listed addresses.
Withdrawals Resume Sept. 28
Bitget has set a phased timeline for restoring withdrawals after completing further checks on its systems, per its withdrawal schedule published Sept. 26: Bitcoin withdrawals resume at 08:00 UTC on Sept. 28, Ethereum withdrawals across the listed networks follow at the same time on Sept. 29, USDT returns on Sept. 30, and remaining tokens, fiat rails and peer-to-peer services come back online on Oct. 2. Deposits and trading never stopped. Bitget paused only withdrawals after detecting unauthorized transfers from portions of its hot and warm wallet systems at 18:31 UTC on Sept. 24; its initial security notice described both wallet tiers as partially affected while cold wallets stayed secure.
Investigators' working reconstruction points to an attacker who compromised a backend wallet service, fed falsified transfer information into Bitget's internal systems and triggered the exchange's own authorization process to move the assets. The preliminary probe ruled out a private-key leak, and Bitget says the attack path has since been identified, the underlying vulnerability fixed and no further unauthorized transfers are possible, with Mandiant and SlowMist assisting the review. The affected assets span XRP, ETH, USDT, ZEC, USDC, USDT0 — Tether's omnichain USDT variant built on LayerZero — tokenized gold XAUt, BNB, AVAX and TRX. Customer balances are unaffected, and Bitget's Protection Fund, valued at more than $464 million in the initial notice, covers the financial impact, though no updated fund valuation has been published alongside the revised loss figure. Chen is scheduled to host a live question-and-answer session at 07:30 UTC on Sept. 28 covering the incident and the restoration of withdrawals.
On-Chain Trail Confirms Post-Mortem
Our read of the primary evidence is that this breach is unusually traceable for its size: four receiving addresses are published across EVM networks, the XRP Ledger, Zcash and TRON, and the on-chain USDC and USDT freezes are independently verifiable. The team's post-mortem is equally concrete: the root cause was a compromised backend wallet service used to feed falsified data into the authorization flow, remediation is complete and no private keys were leaked. The 5%-plus-5% bounty structure echoes Bybit's LazarusBounty and is hardening into an industry playbook for clawing back stolen funds. For depositors weighing exchange custody against self-managed options, from hardware devices to an AI crypto wallet, the lesson is that even major venues carry backend risk.

• Grok captured 59.54% of Coinbase AI agent notional trading volume between September 14 and 21.
• ChatGPT held a 1.54% agent volume share, roughly 40 times smaller than Grok's.
• Custom CLI setups ranked second at 21.73%, followed by Claude at 13.37%.
Grok's 59.54% Share of Agent Volume
Elon Musk's Grok has taken command of AI-driven trading on Coinbase, capturing 59.54% of all notional order volume dispatched by AI agents to the exchange between September 14 and September 21. The figure comes from a developer-platform chart, “Where Agentic Traders Come From,” which sorts every agent-sent order by the large language model behind it — and it places Grok nearly 40 times ahead of ChatGPT, which managed just 1.54% of the same week's agent volume. The rest of the leaderboard: custom command-line configurations at 21.73%, Anthropic's Claude at 13.37%, Perplexity at 3.48% and Claude Code at 0.35%. The exchange's developer account published the notional-volume breakdown, and CEO Brian Armstrong followed with a one-line verdict: “Grok is currently the client of choice for agentic traders on Coinbase.” The lopsided split has a plausible structural explanation. Grok is natively embedded in X, the platform where crypto traders already spend their days, so moving from reading market chatter to ordering an agent to act on it is a single step. Coinbase itself noted it does not usually disclose which chatbots its customers trade through, making this week's disclosure unusual. But the chart measures the value of executed orders, not the number of users, so a small group of Grok-powered traders placing large orders could be inflating the pie — no data was released on per-agent user counts or the asset mix behind the volumes. ChatGPT and Claude were, notably, the first launch partners when the program opened in June, and three months later their combined share sits below 15%. That is a striking reversal for the two most widely adopted consumer AI assistants, and it raises the question of whether distribution — where the model already lives — now matters more to trading volume than raw model quality.
Coinbase for Agents Expands to US Stocks
The program behind these numbers, Coinbase for Agents, launched on June 11 with ChatGPT and Claude as its first partners. It lets users connect an AI assistant to their exchange account for spot and derivatives trading, market-data queries and service payments, all inside a segregated portfolio with spending caps, per-asset permissions and per-action approval flows — the guardrails security researchers have long urged for autonomous software. Connectivity is not uniform, which matters for reading the market-share chart: Grok and Perplexity connect through official Coinbase connectors, while ChatGPT and Claude route through the Model Context Protocol, a standard for wiring AI models to external services. Coinbase — regularly ranked among the best crypto exchanges — pushed agent access further on September 22, extending it to US equities and ETFs through Coinbase Capital Markets Corp. The expansion covers thousands of listed stocks, 24/5 trading, fractional shares from $1 and zero commissions, with a three-step setup from Perplexity, Grok, ChatGPT or Claude. Agent fees settle automatically through x402, Coinbase's micropayment protocol, which bills data and analytics costs in exit liquidity providers' favorite quoting currency — USDC; cumulative x402 activity has surpassed 230 million transactions and $54 million in volume, although the share attributable to agent trading has not been broken out. The ecosystem is starting to pay its own builders too. In the same week, X introduced the “Grok Bot Creator Rewards” pilot, paying developers bi-weekly through X Money based on how often users invoke their public bots. One creator reported $500 in earnings from the first two-week cycle. The program is invite-only and US-first, pays through X's existing creator-rewards rails, and counts usage and repeat usage only — likes and impressions are excluded from the formula.
Notional Share Is Not Trading Skill
The official developer post is the primary record here, and it is candid about its own limits: the split reflects notional order value for a single week, not user counts, returns or trading judgment. COINOTAG's read is that distribution, not intelligence, drove Grok's lead — native connectors versus MCP routing shape access friction more than model quality does. Autonomous agents chasing identical signals can also amplify slippage and crowd into exit liquidity at turning points, so the caveats are not FUD but due diligence. Trading-focused networks such as Fogo are eyeing the same agentic frontier, and until weekly data includes per-model users and performance, Grok's dominance remains a volume story rather than a skill story.

• Crypto derivatives saw $178.36 million liquidated over 24 hours as of September 26, 11:00 UTC.
• Long positions took 52.90% of total liquidations, about 1.1 times the short-side share.
• Bitcoin led all assets with $58.56 million liquidated, 71% from long positions.
Bitcoin Takes the Largest Share
Leveraged traders lost $178.36 million across crypto derivatives markets in the past 24 hours, and Bitcoin took the largest single-asset share of the wipeout: $58.56 million, roughly one third of the entire total, with 71% of that figure coming from long positions. The tally, compiled from derivatives venue data covering the top 20 liquidated assets and timestamped to 11:00 UTC on September 26, skews against leveraged buyers across the board — long liquidations reached $94.36 million, or 52.90% of the grand total, about 1.1 times the $84.00 million forced out of short traders. A liquidation is the automatic, forced closure of a margined position once losses exhaust its collateral; longs are the positions betting on higher prices, so a majority-long share like this marks a session where an upside trade got crowded and then unwound. Bitcoin itself slipped 0.63% over the window to $84,168 at the snapshot and holds near $84,200 as of writing, while Ethereum lost 0.95% to $2,687, trading around $2,690 now. The modest size of the underlying move is the notable part: a 0.63% drift in Bitcoin was enough to cascade through thin-margin longs, which says more about positioning than about any directional break. That dynamic is familiar to anyone tracking perpetual futures trading volume, where leverage tends to build fastest after quiet uptrends and unwind hardest on the first stall. It is also a mechanism equity products never carry — a holder of a Nasdaq-100 ETF rides a drawdown without margin machinery, while a leveraged crypto position closes itself the moment collateral runs dry, converting a small drift into realized losses.
Altcoin Liquidations Split by Side
Ethereum absorbed the second-largest tally at $40.55 million, with 53% from longs — a milder skew than Bitcoin's — and the closures arrived without reported stress on network gas fee costs, marking it as a derivatives event rather than an on-chain one. The more revealing split sits further down the leaderboard. Solana recorded $19.64 million in liquidations, but 76% of it came from shorts, the flip side of a 1.17% gain that squeezed leveraged sellers out of a rising tape. XRP took $16.92 million with an even 50-50 division between the two sides, its price easing 0.50%. Zcash's $7.75 million was 54% long, consistent with the sharpest major-asset decline of the session at -4.07%. Sui saw $6.97 million wiped out with 68% from shorts, Ethena's ENA took $6.51 million at an 83% short skew — the most one-sided ratio in the top tier — and NEAR closed the ranked list at $5.00 million, 53% shorts. Hyperliquid's HYPE token fell 2.17% over the same window. Notional figures measure position size at the moment of closure, so the dollar totals track where large margin sat rather than where the most individual accounts were hit; retail-sized positions dominate the count while bigger books dominate the notional. The map that emerges is not a clean directional squeeze. Longs bore the damage in Bitcoin, Ethereum and ZEC while shorts were flushed in Solana, SUI, ENA and NEAR — a pattern of rotation out of majors and into select altcoins that caught both sides of the leverage book on the way through, rather than one trend liquidating a single side.
Whether Longs Rebuild
COINOTAG's reading of the derivatives record keeps both concentrations anchored to their denominators: the 71% is a share of Bitcoin's $58.56 million, and the 52.90% is a share of the full $178.36 million — each figure holds only within those bases, and against a sub-1% daily move in the underlying asset they describe leverage washed out, not conviction destroyed. The primary record here is the venue data itself, hour-stamped and side-by-side broken out, and it shows a market that deleveraged without breaking trend. The forward question is where rebuilt leverage lands — whether longs stack back into perpetuals or rotate toward structures such as Bitcoin DeFi collateral — and the next funding-rate prints will show which side of the book is paying to stay on.

• Harvey charges $1,200 to $1,500 or more per seat monthly under annual contracts.
• Agent-mode tasks consume tens to hundreds of times more tokens than simple queries.
• Harvey Tenet launched August 20 on Moonshot AI's open-weight Kimi K3 model.
-50% Gross Margin
Harvey, the legal AI startup valued at $15.6 billion, watched its gross margin swing from roughly +50% at the start of the year to negative 50% by June, a collapse triggered by runaway customer usage and inference costs after its March agent update. The economics behind the reversal are stark: Harvey charges law firms and enterprise clients seat fees of $1,200 to $1,500 or more per user each month, locked into the industry-standard all-you-can-eat annual contract. On paper, that pricing should support software-grade margins above 80%. Instead, disclosed figures show the company was effectively losing money on every heavy client it served.
The mechanism is agentic workload. Early legal AI usage meant single-turn questions, quick translations, or short memo summaries — negligible compute. Once autonomous agent mode arrived, lawyers began feeding in entire dockets of hundreds of pages and cross-border merger contracts stretching past a thousand pages. To complete deep due diligence or a full contract cross-review, the system runs multi-round chain-of-thought reasoning, repeatedly calls external retrieval tools, reconciles contradictions, and rewrites its own output several times. A single task can burn tens to hundreds of times the tokens of a simple query — workload that ultimately lands on the GPU fleets NVIDIA supplies and the hyperscale clouds run by providers like Amazon. And the dependency is sticky: once a lawyer has reviewed a thousand-page contract in minutes, manual review is no longer acceptable. Fixed seat pricing simply cannot absorb that curve.
Harvey Tenet on Kimi K3
Harvey's answer arrived on August 20 with Harvey Tenet, a proprietary model built on the open-weight Kimi K3 from Moonshot AI and co-developed with Fireworks Research, with task-specific post-processing designed for long, multi-step agent sessions. Company research materials argue the open-weight approach cuts not just the per-token price but the number of tokens each task consumes, by trimming redundant tool calls and reasoning stages while holding output quality constant. In Harvey's own evaluation environment, Tenet completed more legal tasks than the base Kimi K3 — though the firm has published no figures proving margin recovery across the actual business, and the benchmark was self-designed. Operationally, Harvey also rolled out per-task model routing: lightweight models handle routine drafting while high-performance models are reserved for complex analysis, with administrators pre-assigning models by workflow. The strategic detail drawing attention: a US legal-tech leader backed by OpenAI's venture arm reached for a Chinese open-weight model to survive its cost crisis, evidence that AI competition has moved from rhetoric to raw inference economics — whether the chips come from NVIDIA or AMD.
Compute-Scarcity Thesis
The throughline for COINOTAG's read is that agentic AI has broken fixed-seat subscription math, pushing professional software toward billing on actual work volume rather than users. That is, at root, a compute-scarcity story — the same demand pressure that underpins decentralized compute narratives in crypto, where networks like the Internet Computer pitch on-chain compute as a public alternative to concentrated hyperscalers. Nothing in Harvey's disclosures changes token fundamentals; what it does confirm is that inference demand from professional users is growing faster than any pricing model assumed.

• SEC Commissioner Hester Peirce resigns effective Oct. 2, 2026, per a letter dated Sept. 21.
• Peirce has directed the SEC Crypto Task Force since Feb. 4, 2025.
• Peirce served roughly eight years; her statutory term expired in June 2025.
Resignation Letter Dated Sept. 21
US Securities and Exchange Commission (SEC) Commissioner Hester Peirce has formally resigned, with her departure set to take effect on Oct. 2, 2026. Peirce, the agency’s most prominent advocate for the Bitcoin and broader digital asset industry, published her resignation letter on her X account on Friday. The letter, addressed to the president and dated Sept. 21, gives no specific reason for the timing of her exit. In it, Peirce describes serving on the commission as “the honor of her professional lifetime” and writes that she leaves the agency under the leadership of Chairman Paul Atkins and Commissioner Mark Uyeda, the two remaining members, both of them Republicans. She also stresses that individual freedom of choice and appropriate regulation that supports trust in markets must coexist, expressing confidence that the current leadership and SEC staff will keep that balance. Peirce first joined the SEC in January 2018 and has served roughly eight years across two terms. Her statutory term expired in June 2025, but agency rules allow commissioners to keep serving for up to approximately 18 months after expiration if no successor is confirmed — the provision that made her extended tenure possible. Beyond her commissioner seat, Peirce has been director of the SEC’s Crypto Task Force since Feb. 4, 2025, a unit whose mandate, laid out in the agency’s official designation letter, is to map how existing securities laws apply to digital assets and decentralized systems. After Washington, Peirce turns to academia: she is expected to join the law school of Regent University in Virginia as an associate professor in November, helping build programs in federal litigation, securities regulation and digital assets.
Task Force Legacy, Vacant Seats
Peirce’s resignation lands while the SEC’s digital asset framework is still being rebuilt. The nickname that defined her career took hold in 2018, when she dissented from the agency’s handling of Bitcoin-linked exchange-traded products — a stance that drew support across the industry, including from the Bitcoin maximalism camp, which had long debated regulated wrappers for the asset. She was sworn in for a second term in August 2020, with that term running to June 5, 2025, and she continued performing commissioner duties well past its expiration. As task force director, she steered the agency’s review of how securities law should reach decentralized systems, and in June 2025 she argued that publishing open-source code should not expose software developers to federal securities regulations — a direct intervention in the developer-liability debate surrounding Bitcoin DeFi and wider decentralized finance. That review fed into the agency’s August 2026 draft rule package, Regulation Crypto Assets, which sets out registration exemptions for token fundraising and a mechanism defining when a crypto asset falls outside investment-contract status. Importantly, the package remains a proposal — it has not been adopted as a final rule, and its exemptions can still change during the comment process. Her seat may not be refilled quickly. The commission’s previous Democratic member, Caroline Crenshaw, departed in January, 18 months after her own term ended, and President Donald Trump has put forward no nomination for either vacancy. Since January 2025, the agency has also dropped several enforcement actions and investigations into crypto companies, including matters tied to Trump and his family — part of a pivot that Chairman Atkins, in remarks at a financial market regulation conference, described as moving away from regulation by enforcement. Whether that posture survives a thinner commission is now an open question.
Two-Member Commission, Open Rule Book
The through-line of Peirce’s tenure is one argument: securities law should draw bright lines for digital assets instead of being stretched case by case. The SEC’s own documents carry that intent — the designation letter establishing the Crypto Task Force binds the agency to defining how federal rules apply to tokens and decentralized networks. Her resignation, effective Oct. 2, hands that unfinished exercise to a two-member commission led by Atkins and Uyeda. And because Regulation Crypto Assets is still a proposal rather than a final rule, its exemptions and safe harbor remain open to revision — whatever text the reshaped commission adopts will shape how projects disclose token economics, from circulating supply schedules to market cap metrics, for years to come.

• Nik Bougalis opened pull request #8300 in the XRPLF/rippled repository, titled “I’m back, baby.”
• The proposal spans eight commits and remained unmerged at Open status as of September 26.
• David Schwartz, Ripple’s CTO Emeritus, publicly endorsed Bougalis’s return in a post on X.
Endorsed by Ripple’s Co-Creator
Nik Bougalis, the cryptographer who steered core XRP Ledger protocol development for close to a decade, is officially back in the project’s source code — and the welcome came from the very top. David Schwartz, Ripple’s CTO Emeritus and a co-creator of the ledger, publicly acknowledged his former colleague’s return in a short post on X; Schwartz has stepped away from active development and rarely comments on individual contributors, so the gesture reads as unusually pointed. He has said before that the only thing able to pull him out of that break would be the chance to work beside Bougalis again. The returning engineer stamped his comeback straight into the repository itself, opening pull request #8300 in the official XRPLF/rippled codebase under the wry title “I’m back, baby.” Bougalis was Ripple’s eighth employee and the author of several of the platform’s key cryptographic patents; he left the project in 2022 and went on to serve as CTO of the Algorand Foundation, an appointment recorded in September 2025. H. Ayo Akinyele, head of engineering at RippleX, has confirmed that Bougalis is being brought in to take on ambitious next-generation technology challenges. The timing is notable: real-world assets are moving onto the layer-1 ledger, the U.S. regulatory landscape keeps shifting, and settlement tooling continues to evolve — themes we unpack in our XRP and PayFi explainers. One caveat deserves equal weight: no formal contract or employment terms between Bougalis and Ripple have been confirmed, so a return to the codebase should not be conflated with a return to the company. For a network run by a blend of in-house and independent contributors, the re-entry of an engineer of this caliber restores a proven engineering tradition at precisely the moment competition for settlement workloads intensifies.
Eight Commits Under Review
The proposal itself is far more than a symbolic gesture. Reading the pull request directly, it spans eight commits and stood at “Open” status as of September 26 — review and merge procedures are still in progress, so nothing here is a live network update. The core target is BaseUInt, the low-level data-type family underpinning hashes, account IDs, currency codes, ledger keys and protocol identifiers across rippled, the C++ server that validators run. Bougalis widens internal arithmetic from 32-bit to 64-bit elements wherever the architecture allows, cutting the number of data units each loop must process. He also removes unsafe raw-pointer constructors and unchecked runtime constructors entirely: fixed-length byte input is now verified at compile time, while dynamic input routed through fromRaw() fails cleanly on any size mismatch — meaning an entire class of errors surfaces during the build rather than after deployment. Per the pull request description, the stated goals are to harden input validation for hash- and ledger-key handling and to reduce lock contention and repeated computation along some paths, improving stability in memory allocation and concurrency. Companion work covers safe casting, a spinlock, a slab allocator, object counting and an improved Base58 cache for account IDs, alongside tightened validation of raw hashes and ledger keys in RPC and peer-to-peer communication. The test matrix is correspondingly broad, covering type construction and parsing, serialization and deserialization, ledger replay, SHAMap proofs, account ID conversion and RPC JSON handling. Notably, automated review on GitHub still flags high-importance items — the raw-pointer constructor removal and a data race in the cache read path — plus open questions on cache API compatibility and the object-counting response format. The merge decision has not been made; being public does not mean the improvement is done.
No Network Impact Yet
Our reading of the changelog-style proposal is that this is hardening, not feature work: fewer errors in type and input handling, less contention on hot paths, no new user-facing capability. Until the review concludes, XRP Ledger operators have nothing to deploy — changes reach a formal release only after testing, merge and a rippled release cut, a sequencing that already saw a validator-backed batch upgrade slip to Oct. 9 this quarter. With settlement data showing AI agents shifting XRPL settlements to Ripple USD and application-specific blockchains multiplying, rebuilding core engineering depth may prove the ledger’s quieter but longer-lived upgrade.

• EGRAG Crypto set $1.75 as the key threshold for his $365 XRP scenario on Sept. 26.
• The scenario's intermediate targets span $5-$8, then $13, based on a 365-day time cycle.
• Kalshi's above-$1.70 XRP contract traded at 32 cents, implying roughly one-in-three odds.
EGRAG Crypto's $365 XRP Scenario
XRP (XRP) closed out the week pinned under two consequential price thresholds, and a long-cycle scenario published Friday spells out what the higher of the two could unlock. Analyst EGRAG Crypto, in a post shared on X on Sept. 26 — his full $365 scenario post — laid out a conditional roadmap that treats $1.75 as the decisive gate. On his chart, that level maps to a long-term structure he labels the “Central Line,” and his first stated condition is that XRP retests the zone and holds above it. Only then does the model activate: the first expansion range runs from $5 to $8, with $13 marked as the following stage — intermediate targets, not endpoints. The more speculative layer is a time-cycle argument. EGRAG identifies what he reads as an approximately 10-year structural similarity spanning 2016 to 2026 and asks whether the roughly 365-day shape of the previous major price expansion could repeat. Combining the two assumptions — a $1.75 starting level plus a 365-day window — produces a symbolic target of $365 per token. The analysis sets no fixed date; the window is a theoretical construction, not a deadline. That $365 figure should be read strictly as a simulation, not a forecast. Reaching it would demand a market capitalization far beyond anything historical circulating supply dynamics have ever approached for XRP, Ripple's settlement asset, and past time similarities do not compel future price behavior. What makes the post worth tracking is less the headline number than the $1.75 gate itself — a concrete, chartable level that would either validate or invalidate the scenario in real time. XRP is nowhere near it yet, changing hands near $1.55 early Saturday after printing its monthly high of $1.64 on Sept. 23 and fading back toward $1.50.
Kalshi Prices $1.70 at 32 Cents
The nearer-term verdict is being priced on the blockchain prediction markets, and there the odds have slipped. Kalshi's September XRP market displays a headline forecast of $1.70, but the actual “above $1.70” contract last traded at 32 cents, down from 36 cents a day earlier. Each contract pays $1 if XRP reaches that strike before the Sept. 30 settlement, so the quote implies roughly a one-in-three probability. Activity at the strike is deep: about 46,650 contracts have traded since the market opened on Sept. 1, with roughly 10,870 still open. Higher strikes are priced as long shots — 19 cents at $1.80 and around 7 cents at both $2.00 and $2.10. The month has already paid out three strikes: $1.40 on Sept. 3, $1.50 on Sept. 21 and $1.60 on Sept. 22. The rally climbed from a trough, with XRP dipping to roughly $1.26 in mid-September — settling the “below $1.30” contract on Sept. 15 — before touching $1.64 on Sept. 23 and easing back. Reaching $1.70 by the 11:59 p.m. ET deadline requires about a 9.8% gain, a magnitude the token matched between Sept. 21 and 22, when it jumped from $1.41 to $1.61. The finish line carries fine print: settlement uses the CF Benchmarks XRP reference rate, a per-minute average that trims the top and bottom 20% of prints and excludes single-exchange one-minute candles, so brief slippage-driven spikes will not decide the contract. Macro drag weighs too: Bitcoin's slide below $87,000 toward roughly $84,000 has pulled the wider altcoin market lower, XRP included, while traders also track the $157 million in XRP stolen in the Bitget hack losses, parked in wallets no one can freeze. Flows lend some support: U.S. spot XRP ETFs booked a $22.65 million net inflow on Sept. 25, continuing a run of Bitwise-led daily purchases. Even so, that buying has not carried XRP back above $1.60, and the longer-dated board leans the other way: 2026 contracts on XRP topping $2.00 firmed from 53 to 59 cents, with $2.50 up from 26 to 33 cents and $3.00 from 19 to 24 cents.
Sept. 30 Settlement in Focus
COINOTAG's read: both frameworks converge on the same band of price. The order book on Kalshi's September contracts — the exchange's own trading record, and the primary document here — prices a one-in-three chance of $1.70 by month-end, while the EGRAG model requires $1.75 merely to stay alive. Between now and Sept. 30, XRP must clear territory that one framework treats as a coin flip and the other treats as step one; until then, both scenarios remain strictly conditional. For a running tally of levels and flows, our XRP price coverage tracks the tape, and readers weighing an entry can start with our guide on where to buy XRP.

• Grayscale filed the ZCSH High Income Zcash ETF with the SEC on September 25.
• The fund holds no ZEC, trading options tied to Grayscale's spot Zcash ETF (ZCSH).
• At least 80% of net assets must sit in options on Zcash exchange-traded products.
Grayscale's Options-Linked Zcash Fund Reaches the SEC
Grayscale Investments has filed to launch an exchange-traded fund that would pay Zcash investors on a biweekly schedule, with distributions funded by options premiums rather than by holding the privacy asset itself. The registration reached the U.S. Securities and Exchange Commission (SEC) on September 25 and, under the standard review clock, could take effect 75 days later — a window that points to early December. The proposed product, named ZCSH High Income, holds none of the privacy-focused Zcash directly. Per the registration statement on SEC EDGAR, it instead trades options tied to The Zcash ETF (ZCSH), Grayscale's existing spot trading fund. An option, briefly defined, is a contract giving its buyer the right to trade an asset at a preset price, while the seller collects an upfront fee known as the premium. The new vehicle would replicate ZCSH's price path by combining purchased call options with sold put options, then write short-dated calls — mostly one month or less — to harvest the premiums that bankroll the payouts. The document requires at least 80% of net assets to sit in options on Zcash exchange-traded products. One caution is written directly into the paperwork: “high income” does not promise any fixed yield, and some distributions may amount to a partial return of the investor's own capital. The filing also leaves the new fund's ticker, listing venue, fee schedule and sub-adviser blank, so the market is judging a product whose final shape is not yet set. The structure, however, is familiar: it extends Grayscale's expanding Zcash product lineup, a chain whose trusted setup ceremony dates back to its 2016 origins.
The Catch and the $914.5M Demand Behind It
The trade-off at the heart of the structure is the one that defines every covered-call strategy: selling calls caps the fund's upside. If ZEC rallies beyond the chosen strike price, ZCSH High Income forfeits those gains, yet it still absorbs the full loss when prices fall — a risk profile that would bite hardest in an outright bear market. Timing compounds the concern. ZCSH only began trading on August 25, and its options market followed on September 8, meaning the premiums the income fund would sell are priced against barely a month of history. Grayscale itself discloses a conflict of interest in the document: an affiliate of the fund's adviser sponsors ZCSH and collects its fee, which public listings put at 2.50%, and the filing notes that the new fund's trading could lift ZCSH demand — and, indirectly, that affiliate's revenue. What makes the income play viable at all is the demand already behind ZCSH. The fund converted from Grayscale's 2017 trust, which held roughly $260 million in assets. By the week ending September 18, its assets had climbed to $914.5 million on $271 million in cumulative inflows, and that week's intake of $98.2 million topped every crypto ETF in the market. The scaling push has been visible elsewhere: Grayscale earlier moved for a 3-for-1 split of the Zcash ETF, and the token itself traded to a multi-year high near $1,590 after a 36% weekly rally. Comparable income products already exist for Bitcoin — Grayscale runs a covered-call Bitcoin ETF, and Goldman Sachs filed a Bitcoin premium income fund in April.
Early December Decision Looms for ZEC
Our reading is that this filing is the clearest sign yet that Zcash — long a niche blockchain for private payments — is being pulled into the institutional product mainstream, with income wrappers following flows the spot fund has already absorbed. The registration statement, the load-bearing primary document here, is explicit that at least 80% of net assets must sit in options on Zcash exchange-traded products and that no yield is guaranteed; COINOTAG treats that disclaimer as the central risk, not fine print. Spot action supplies a reality check: ZEC slipped roughly 4.2% over the past 24 hours at the time of writing. Bulls can point to co-founder Eli Ben-Sasson's $5,000 year-end forecast, while skeptics note the capped upside; for those weighing exposure, our step-by-step guide to buying ZEC covers the practical options.

• Bitget will resume Bitcoin (BTC) withdrawals at 08:00 UTC on Sep. 28, first of four stages.
• Losses from the Sep. 24 attack were revised up 10.2% to $387.5 million from $351.6 million.
• Attackers breached Bitget's backend wallet system and forged transaction data; private keys were not compromised.
Bitcoin Withdrawals Return First on Sep. 28
Bitget will restart Bitcoin (BTC) withdrawals at 08:00 UTC on Sep. 28, the first step of a four-stage reopening plan the exchange published after a security incident on Sep. 24 forced it to suspend all outbound transfers. The exchange had detected unauthorized transfers from some of its wallets that day and halted withdrawals while tracing the outflows, even as trading and deposits stayed open. According to the official announcement, Ether (ETH) withdrawals follow at the same hour on Sep. 29 across five networks — the Ethereum network, BNB Smart Chain, Arbitrum, Base and Optimism — with USDT set for Sep. 30 on Ethereum, BNB Smart Chain, Solana and Tron. Remaining tokens, fiat services and peer-to-peer transactions close out the schedule on Oct. 2. Two details in the plan matter for customers. A token's return date does not mean every network reopens at once: Bitget named five chains for ETH and four for USDT, and gave no network-by-network list for the assets in the final stage. And the pause never touched balances — the exchange described the suspension as a temporary security measure, said customer account balances were unchanged, and told users no action is required before withdrawals resume, with each service confirmed through official notices as checks complete. On the forensic side, the technical team says it has identified and fixed the vulnerabilities tied to the incident and is re-verifying withdrawal systems before they go live again, with Mandiant, the cybersecurity firm owned by Google, and blockchain security firm SlowMist assisting. The stages convert to mid-afternoon local time in Asian markets, a timing detail regional desks flagged quickly. For customers in stage one, the Sep. 28 Bitcoin window is the first hard date — and the first live test of whether the patched systems hold under real load.
$387.5M Revision and the Backend Breach
Bitget's revised accounting now puts transfers to attacker-controlled addresses at about $387.5 million, up from its initial estimate of $351.6 million — an increase of roughly $35.9 million, or 10.2%. The revision is not a second theft: continued tracing added Zcash and TRON assets the first tally had not fully counted, and the exchange says no new unauthorized transfers have occurred since the incident was contained. Confirmed affected assets span XRP, ETH, USDT, ZEC, USDC, USDT0, XAUt, BNB, AVAX and TRX, moving across Ethereum and other EVM-compatible chains, the XRP Ledger, Zcash and Tron. The root-cause disclosure is the most consequential detail in the post-mortem. Bitget says attackers did not obtain private keys; they broke into a critical backend system in the exchange's wallet infrastructure, forged transaction data and triggered the platform's own legitimate signing flow — the system itself signed malicious transactions that looked like valid authorization. In a public update on X, Bitget said its technical team has identified and fixed those vulnerabilities. Chief Executive Gracy Chen earlier raised a possible North Korean connection, citing IP-address and VPN similarities, though no government attribution has been confirmed. Recovery mechanics are already running. Bitget published the attacker addresses and launched a Recovery Bounty Program paying 5% of the value of any assets a third party freezes or helps recover; leads are being collected through Bybit's LazarusBounty platform. On-chain analytics firm Bitquery traced at least 126.71 BTC in whale-scale conversions from stolen BNB and TRX as of Sep. 25, and Tether has frozen roughly 239,000 USDT across two attacker addresses. The backstop is the User Protection Fund, which Bitget reported at more than $464 million during the pause; according to Blockcast, the fund's core holding is 5,500 BTC — a reserve that functions much like a miniature strategic bitcoin reserve — and a loss of this size equals roughly 84% of its marked value.
On-Chain Clawback Gains Urgency
COINOTAG's read of the on-chain flow is that the clock now works against the attacker: conversions into at least 126.71 BTC and Tether's freeze of about 239,000 USDT show exit liquidity being hunted in real time, while a 5% bounty turns the market itself into a distributed tracing network. The backend-signing root cause — not a private-key leak — limits the blast radius and keeps cold-wallet architecture intact, which is why the staged restart under external forensics looks credible. The open question is the fund: absorbing a hit equal to roughly 84% of its marked value is a stress test few exchange insurance funds have faced, and how Bitget replenishes it will shape how traders weigh custodial HODL convenience against self-custody — a comparison our Best Crypto Exchanges guide tracks closely.

• BatchV1_1 activation pushed from Sept. 29 to Oct. 9 after validator support dipped below threshold.
• BatchV1_1 held backing from 30 of 35 trusted validators as of Sept. 25.
• Batch bundles up to eight transactions with an all-or-nothing settlement option.
Batch Countdown Resets to Oct. 9
The XRP Ledger's flagship Batch upgrade has lost at least ten days on its activation schedule. BatchV1_1, the amendment that lets users bundle up to eight transactions into a single atomic operation, had been counting down toward a Sept. 29 activation since Sept. 15 — but validator support briefly fell below the level required to keep that clock running. Under the ledger's amendment rules, a protocol change must hold the backing of more than 80% of trusted validators for two consecutive weeks before it goes live, and any dip below that line wipes out the accumulated waiting time, even when votes return within hours. The XRPL amendment dashboard now shows BatchV1_1 back at 30 of 35 trusted validators as of Sept. 25, resetting the earliest possible activation to Oct. 9 at around 14:46 UTC.
What Batch changes is execution semantics rather than raw throughput. Its all-or-nothing option means a buyer paying for a tokenized asset can have payment and asset transfer settle in one operation, so neither side of a trade can complete alone — a structure aimed directly at tokenized-asset settlement and payment-versus-delivery risk. The feature is also a second attempt: the original Batch implementation was withdrawn before mainnet activation after developers identified a critical signature-checking flaw, and the corrected version shipped in August with xrpld 3.3.0, the software that runs the ledger. RippleX head of engineering Ayo Akinyele has said some projects are already being built with Batch in mind and that activation would move that work closer to production, though he has not named partners or launch dates. The dip appears to have lasted only briefly, but the rules leave no margin: support recovered quickly, the calendar did not.
Delegation Upgrade Also Slips
A second amendment slipped on the same clock. PermissionDelegationV1_1, an upgrade that lets an account owner authorize another account to perform specific approved tasks without sharing the signing keys that control its funds, lost its qualifying support on Sept. 23 and regained it a day later. That reset moved its earliest activation from Oct. 5 to Oct. 8, at roughly 21:25 UTC — putting two of the ledger's pending amendments on track to land within about 24 hours of each other, provided support holds. The dashboard record we reviewed shows both amendments following the same pattern: support lost, restored within a day, and the full calendar cost absorbed by the activation date rather than the code itself.
The mechanism matters most for institutions. A token issuer on the ledger — a layer-1 network purpose-built for payments — could assign payment execution and compliance checks to separate operational accounts without ever exposing the master key guarding its treasury, the same division of duties auditors expect in traditional finance. Combined with Batch, delegation opens the door to role-separated, atomic settlement workflows: one account authorized to deliver assets, another to release payment, each action executing or failing together. Validators, the operators that check transactions and vote on network changes, effectively acted as a brake on both amendments inside a single week. That is not a technical failure; it is the ledger's deliberately conservative activation process working as designed, where any wobble in consensus support restarts a two-week observation window instead of forcing a change through with weakened backing. For market participants, the practical effect is a compressed mid-October window in which two governance changes could take effect back-to-back, each reshaping how settlement and account authorization work on a network whose activity increasingly anchors the XRP ecosystem.
Oct. 8 and Oct. 9 Are the Dates That Matter
Our reading: the double reset is less a setback than proof the ledger's governance trades speed for predictability, and the direct impact on the XRP price should be minimal. Both amendments already ship in xrpld 3.3.0, so node operators need no new action beyond holding support steady. If consensus holds, Oct. 8 and Oct. 9 are the dates to watch — batching plus delegation move the network closer to the atomic, role-separated settlement that tokenized-asset and PayFi workflows demand. Institutional demand has continued through the delay, with XRP ETF inflows recently led by Bitwise at $9.91 million in daily purchases, while 30-day data shows AI agents on XRPL shifting settlement preference toward Ripple USD — a reminder that the ledger's payment narrative keeps evolving regardless of upgrade dates.

• CFTC sued Cash FX Group and three individuals over a $950 million crypto-linked forex Ponzi scheme.
• The complaint was filed in the US District Court for the Middle District of Florida.
• The scheme promised investors weekly returns of up to 15% via AI and expert traders.
CFTC Moves on $950 Million Forex Pool
The United States Commodity Futures Trading Commission has filed suit against Cash FX Group and three associated individuals, alleging a foreign-exchange investment fraud of roughly $950 million that used cryptocurrency as part of its payout machinery. The complaint was lodged Friday in the US District Court for the Middle District of Florida, and the agency's own press release describes a multilevel marketing Ponzi operation that solicited and accepted more than $950 million from participants whose money was purportedly traded in retail foreign currency contracts through a commodity pool. The scale alone places the case among the largest retail fraud actions the derivatives regulator has brought against a token-era scheme.
The core allegation is stark. The defendants marketed the pool by claiming participant funds were managed by expert traders, proprietary algorithms and artificial intelligence, and they dangled returns of up to 15% per week — a rate that, compounded, would imply gains no legitimate trading desk could sustain. In reality, the Commission alleges, Cash FX carried out only minimal forex trading. Most participant money was misappropriated: fresh contributions were recycled to pay fictitious trading profits to earlier members, while millions of dollars were channeled directly to each of the defendants. The agency further contends that Cash FX distributed false accounting statements to mask the pool's deterioration and that participant losses amount to at least $406 million. David I. Miller, the CFTC's Director of Enforcement, framed the action as evidence of the division's renewed focus, saying it reflects a steadfast commitment to addressing fraud wherever the agency finds it.
Three Individuals, Two Companies Charged
The defendants named alongside the company sketch a cross-border operation. Cash FX's chief executive, Huascar Jose Lopez Castillo, is based in Brazil, a market whose listed-equity proxy, the EWZ ETF, has long absorbed the country's shifting retail flows. The second corporate defendant, The Conversion Pros, is led by Ronald Pope of Oregon, while Justin Halladay of Florida completes the charged group. The complaint does not allege that any defendant ran a licensed trading operation; the trading claim, in the agency's telling, served as the wrapper around a recruitment engine in which commissions flowed to those who brought in new deposits — a structure recognizable from the promotional networks that surround memecoin launches, where marketing reach rather than trading skill moves the money.
The suit also lands at a delicate moment for the Commission's digital-asset agenda. On September 18, the CFTC submitted a regulatory action covering crypto asset transactions and markets for White House review, signaling that it intends to shape how the digital asset sector is supervised; the substance of the planned rules has not been disclosed. That submission came just days after the Senate failed to advance the CLARITY Act, the bill that would have established a federal regulatory framework for crypto markets and given HODL-style long-term holders in Bitcoin (BTC) and other assets a clearer statutory footing. Until such a framework clears Congress, the Commission's sharpest crypto instrument remains its enforcement docket.
Enforcement Fills the CLARITY Act Gap
In our reading of the enforcement record, this case and the parallel rulemaking push describe the same strategy from two directions: with the CLARITY Act stalled in the Senate, the CFTC is defining its crypto jurisdiction one docket at a time. The primary document here — the agency's own release — states the two figures that matter: more than $950 million solicited and at least $406 million in participant losses, alongside the allegation that only minimal actual trading took place. For retail investors, the arithmetic itself is the warning: promised yields of up to 15% per week exceed what disciplined positioning captures across an entire all-time-high cycle, and that gap marks the scheme as fraudulent regardless of how the broader regulatory debate resolves.

• US spot Ethereum ETFs took in $87 million net on Sept 25, a sixth straight inflow session.
• VanEck's ETHV has drawn $6.73 billion cumulative while Grayscale's ETHE shed $541.27 million.
• August net inflows totaled $1.85 billion across the US spot Ethereum ETF complex.
Six Sessions Without a Redemption
The run of money into United States spot Ethereum (ETH) exchange-traded funds has not broken. For a sixth consecutive trading session, the spot ETF complex took in more capital than it returned, and Friday's print — $87.00 million in net inflows on Sept 25 — arrived as one more instance of the same pattern rather than a turn within it. Daily flow data compiled across the products shows the streak now reaches back to Sept 18, with no single session of net redemptions in between. The composition of the latest day was concentrated at the top: BlackRock's ETHA, the largest fund in the complex, absorbed $50.40 million, close to three-fifths of the day's total, while the issuer's newer ETHB share class added $31.90 million. Fidelity's FETH contributed $4.70 million. The rest of the group — VanEck's ETHV, Morgan Stanley's MSSE, Bitwise's ETHW, Grayscale's ETH trust, Franklin Templeton's EZET, 21Shares' TETH and Invesco Galaxy's QETH — recorded no flows either way. That flatness matters as much as the headline figure: a session that extended the streak produced not one outflow from any issuer, meaning the one-directional character of the week held through every product line at once. For readers tracking Ethereum market coverage, the relevant point is that this is the sixth straight print in which the complex as a whole finished positive — the streak is now defined less by any single day's size than by the absence of a counterexample. Friday's $87.00 million is modest against some earlier sessions, but the streak's length, six sessions without exception, is what the flow tape now shows.
The mechanism behind the numbers is straightforward. A spot ETF holds ETH directly, and issuers publish net creations and redemptions each session, so the daily figure reflects primary-market demand for the underlying asset rather than secondary trading. The six-session run sits inside a longer history defined by rotation rather than uniform appetite: VanEck's ETHV has drawn $6.73 billion in cumulative net inflows since listing, while Grayscale's ETHE, the legacy trust, has shed $541.27 million over the same span — capital migrating from the older wrapper into lower-cost funds. August closed with $1.85 billion in net inflows, and September has so far kept the same direction. Sustained creations feed into price through a simple channel: shares issued against cash mean steady buy-side demand for ETH in the open market. That demand touches the network itself, which runs on proof of stake, where staking locks ETH to secure the chain and underpins the yield that many of these wrappers are increasingly built around. Regulatory clarity on those structures has been moving in parallel: as our related reporting noted, SEC staff's Sept 25 FAQ stated that Ethereum staking receipt tokens are not securities — a determination with direct consequences for restaking products that reuse staked ETH for extra yield. Investors weighing the upgrade path that reshaped the asset can consult our guide, From Ethereum 1.0 to 2.0, for the staking redesign context.
The $2,681 Floor Flows Have Not Moved
While the flows accumulated, spot has stayed where it was: ETH trades near $2,685, up 0.45% over 24 hours, and COINOTAG's proprietary 42-indicator composite S/R scoring engine rates the $2,681 support at 86/100, driven by a resistance-turned-support flip, the Fibonacci 0.114 retracement and a MACD cross. Overhead, the $2,799 resistance scores 85/100 on the Donchian Upper band and the swing high, with a nearer shelf at $2,700.65 rated 55/100. Positioning remains mildly long — funding at 0.0007%, open interest of $11.14 billion and a 1.52 long/short account ratio (60.3% long) — while the Fear & Greed Index sits at 74, in Greed. The bullish case is a hold of $2,681 opening a grind toward $2,799; a daily close beneath that support would invalidate it. What the week left undisturbed is the standing condition: the uptrend, RSI at 63 and a bullish MACD, exactly where the flows found it.