Bitget said BTC withdrawals are now live on the Bitcoin mainnet and BSC, with 9,585 orders and 4,098.036 BTC processed as of 17:00 UTC+8. The exchange said ETH, USDT and other assets will reopen in phases starting tomorrow. Bitget said the incident stemmed from vulnerabilities in third-party products that enabled an attacker to obtain internal credentials and submit fraudulent withdrawal commands that bypassed risk controls, while private keys and cold wallets were not affected. The platform said user funds are fully covered by the Bitget Protection Fund and it will replenish the fund to >$300M with its own capital within the week.

The U.S. Securities and Exchange Commission has provided interim regulatory clarity on Ethereum staking, with 1.68 million ETH currently awaiting processing. The guidance is intended to offer market participants transitional direction and delineate compliance boundaries for staking services, but it does not yet establish a final rule framework. The move underscores regulators’ ongoing focus on crypto staking activities and may ease near-term policy uncertainty, while the long-term compliance path remains to be clarified.

Ripple has received early approval for an EU Markets in Crypto-Assets (MiCA) license in Luxembourg, positioning it to offer compliant crypto-asset services for European payment rails. The approval is expected to speed up processing across Europe’s payment networks. The company also plans to open institutional onramps this quarter. The move marks a key step in Ripple’s EU compliance rollout.

The number of tokenized equity holders on the Solana blockchain has surpassed 1 million for the first time. The milestone signals a new high in adoption of real-world asset tokenization on the network. It also reflects market validation of Solana’s infrastructure for supporting compliant security tokens.

Payy’s bridging protocol was hit by a security exploit that has frozen its crypto card services, putting users’ account balances at risk. The attacker allegedly used a vulnerability in the bridge contract to move assets illegally, including stablecoins such as USDC. Affected users are unable to make payments or withdraw funds. The incident underscores serious weaknesses in Payy’s asset custody and cross-chain bridge security, directly disrupting crypto payment apps that rely on its services.

Bitget CEO Gracy Chen said the exchange’s $351M security incident affected several major blockchain networks, including Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC and Base. Tokens impacted include ETH, XRP, BNB, AVAX, USDT and USDC. Bitget said its on-chain cold wallets were not breached and that Bitget Wallet operates independently and was not affected. The exchange has contacted each affected chain’s foundation, with some confirming freezes on suspected hacker addresses, according to Chen.

Bitget’s CEO said in a livestream that the exchange suffered a security incident in which assets were stolen from hot wallets, involving ETH, XRP, BNB, AVAX, USDT and USDC across seven blockchains including Ethereum and the XRP Ledger. XRP was described as the largest single-chain loss. On-chain analysis indicates the attack method matches techniques used by DPRK-linked hacker groups, the CEO said.

An exchange said a vulnerability in a third-party back-end tool allowed forged instructions to bypass its wallet approval process, resulting in the theft of about 103 million XRP and 31,890 ETH worth about $357 million. The estimate was slightly revised up from a previous $351.6 million. It has suspended withdrawals because it is not yet certain the flaw has been fully patched and fears resuming withdrawals prematurely could lead to another theft. The attacker IP characteristics match VPN patterns commonly used by known North Korea-linked hacking groups, the exchange said.