brief -
Exploits Hit Bitget, Payy, And NFT Contracts
A $387 million exchange breach, a rollup bridge exploit, and a white hat operation rescues over 23,000 NFTs.
Happy Friday, September 25, 2026.
It's been a steep 24 hours for onchain security. Bitget suffers a $387 million hack on its exchange hot wallets. An attacker exploits a bug in Limit Break's NFT marketplace settlement contract. Payy Network suffers an exploit on its Ethereum L1 bridge contract. And Aave v4 supports Coinbase Tokenized Stocks on Base.
On the brighter side, Ethereum researchers make progress on decoupled consensus and the SEC shares an FAQ on token buybacks and LSTs.
Advertise
ETH Daily is the trusted Ethereum news briefing since 2022, reaching 10,000+ subscribers. Want to reach the ETH Daily audience? Learn more at ethdaily.io/ads.
Bitget Suffers $387 Million Hack
Bitget, a global centralized exchange, suffered a hack on the exchange’s hot wallets at 18:31 UTC on September 24, 2026, resulting in the loss of over $387 million involving funds across Ethereum, EVM-compatible networks, XRP, Zcash, and TRON. Bitget stated that its cold wallets are secure and impacted user funds will be compensated by the exchange's $464 million User Protection Fund.
Bitget has suspended withdrawals from the exchange while it coordinates with cybersecurity partners on a security review. Bitget also launched a Recovery Bounty Program, offering 5% of recovered or frozen assets to contributors. The attacker is linked to the North Korean Lazarus Group. The attacker was able to compromise a backend system to spoof transfer data and get Bitget to approve fund transfers out of the exchange.
Hacker Drains 660 WETH In Limit Break Exploit
An attacker exploited a bug in Limit Break’s Payment Processor V2, an NFT marketplace settlement contract used by Magic Eden for EVM NFT trades in 2024. The attacker was able to steal 660 WETH alongside 10 Meebits, 50 Otherdeeds, and 10 WoW NFTs, among others. The bug also impacts Limit Break’s Payment Processor V3 on Ethereum mainnet and ApeChain, which has been paused.
Quit, a VP of Blockchain at Yuga Labs, executed an overnight white hat operation rescuing over 23,000 NFTs, worth an estimated $5.7 million. Impacted users are advised to revoke token approvals for the V2 and V3 contract. Once revoked, users who had their NFTs rescued will be able to claim them back using a claim portal built by Quit.
Payy Exploit Drains Bridge Contract
Payy Network, a privacy-focused Ethereum L2, suffered an exploit on its Ethereum L1 bridge contract, resulting in the loss of its full contract balance, inclusive of user non-custodial deposits held on the network and on Payy Wallet. The loss is estimated to be around 1.8 million USDC. Payy Network has paused deposits, withdrawals, transfers and card transactions while it investigates the incident.
Payy is working to determine the exploit’s root cause, which it says did not involve a compromised key, social engineering or its off-chain infrastructure. It's believed that the attacker injected a fake burn message into the rollup's proven public inputs, effectively forging a withdrawal into an otherwise normal verified transaction batch. The batch used Payy’s prover path and validator signatures.
Aave Supports Coinbase Tokenized Stocks
Aave V4 now supports Coinbase Tokenized Stocks as collateral on the Aave V4 Base market. Users can now borrow USDC against AAPLc, AMZNc, GOOGLc, METAc, MSFTc, NVDAc, and TSLAc deposits. The integration on Aave leverages Chainlink’s 24/5 tokenized equity feeds, which account for both the underlying market price and a corporate-action multiplier. Launched in August, Coinbase Tokenized Stocks onchain equities issued by Coinbase and backed 1:1 by shares held in custody.
Misc News
Catch up with Ethereal news mini #2. Explore a client history diagram of Ethereum and a new Ethlabs proposal for a formally verified consensus protocol targeting 4-8x faster finality. Ethereum trace interop hits 42 merged PRs across clients and specs.
Aerodrome expands to Base, Arbitrum, OP, Ink, and Robinhood Chain. Jumper announces the JUMP token sale.
A post-quantum testnet is live. Fairblock releases confidential payment links. Balancer’s window vote goes live. SEC Commissioner Hester Peirce resigns effective October 2; new SEC staff FAQs clarify token buybacks and LST status.
Disclaimer: Content is for informational and educational purposes only and does not constitute financial, investment, legal, or other professional advice. No representations or warranties are made as to accuracy, completeness, or timeliness. Use of this content is at your own risk, and you should consult a qualified professional before making decisions. No fiduciary or advisory relationship is created.
