September Crypto Review: $1B in Attributed Theft, Record Bitcoin ETF Inflows and Faster L1 Finality
| Shelf | Bitcoin |
|---|---|
| Date in | |
| Readers | 799 |
September brought major wallet and sidechain losses, a record $2.4B Bitcoin ETF week, and new sub-second finality deployments.
September put two different sides of crypto infrastructure in sharp relief: operational failures led to hundreds of millions of dollars in losses, while institutional flows strengthened and new chains targeted faster settlement. The largest incidents were concentrated in two systems, not spread evenly across the month. Meanwhile, Bitcoin funds recorded a weekly inflow high, and Circle’s Arc mainnet brought a USDC-based Layer 1 into service with Blockscout as its explorer.
Two incidents drove most September losses
Bitget reported unauthorized transfers from several hot wallets on September 24. The attack resulted in losses of about $351.6 million, making it the largest crypto exchange attack of the year. The described route was through the exchange’s backend wallet system: attackers spoofed transfer data and induced Bitget’s authorization-signing process to approve withdrawals. That account points to a failure in the systems and controls surrounding wallet operations, rather than a break in the underlying blockchain cryptography.
Elliptic attributed the attack to North Korea. The incident lifted the country’s tracked crypto haul for 2026 above $1 billion across more than 50 incidents. Attribution is an assessment by an analytics firm, not a public accounting of every incident or a statement that all proceeds have been recovered. For exchanges, the operational detail matters: wallet permissions, transaction data, and signing workflows can create attack paths even when the base chain itself continues to operate as designed.
Bloomberg on the Bitget attack
Earlier in the month, on September 7, an attacker took roughly 4,000 BTC from a Liquid Network wallet holding about 4,200 BTC. The stolen amount was valued at approximately $320 million. Liquid is a Bitcoin sidechain used by several exchanges to move funds, so the incident affected infrastructure that supports asset transfers rather than Bitcoin’s base layer.
Bitget and Liquid together accounted for 98% of September’s approximately $684 million in exploit losses. That concentration is a useful reminder for operators and users assessing system risk: a chain’s consensus design is only one part of the security picture. Wallet custody, signing procedures, access controls, and the services that connect a chain to exchanges all shape how assets can be moved—and how much can be lost when safeguards fail.
Bloomberg on the Liquid Network incident
Bitcoin fund flows swung back into positive territory
Institutional fund flows moved in the opposite direction from the month’s security incidents. In the week ending September 25, US spot Bitcoin ETFs brought in about $2.4 billion, their largest weekly inflow since October, with buying across seven consecutive sessions. The period’s inflows brought the funds to roughly $800 million net positive for 2026, reversing a $5.8 billion deficit recorded in July.
Spot ETH ETFs added $689.9 million over the same stretch. Bitcoin held above $84,000, while the total crypto market briefly regained a $3 trillion valuation. These figures describe a short period of fund activity and market pricing; they don’t establish whether the inflows will persist. For asset managers and market observers, the notable shift is that cumulative Bitcoin ETF flows for the year moved from negative to positive during a single strong week.
The Block on the weekly ETF inflows
Arc puts USDC at the center of a new Layer 1
Circle’s Arc mainnet went live in September, with Blockscout providing its explorer from launch. Arc is an open, EVM-compatible Layer 1 designed for financial-market activity, including real-time settlement. USDC serves as its gas token, making the stablecoin part of the chain’s transaction-fee mechanism rather than merely an asset transferred across it. The design also includes optimizations for agentic use cases.
At explorer.arc.io, users can inspect transactions, addresses, contracts, and gas. Verified contract source and decoded logs are available from the chain’s first block. An explorer doesn’t determine whether a transaction or application is safe, but it gives users and developers a way to examine on-chain activity and contract behavior. With a dollar-denominated token paying gas, Arc’s design also makes the fee asset and the settlement asset closely connected. That may simplify some payment flows, while leaving users dependent on the chain’s operation and the systems supporting USDC.
Explorer tooling and token metadata updates
Blockscout introduced the Autoscout Wizard, which takes a chain’s RPC endpoint as its starting input and helps create an explorer. The stated aim is to take a new network from endpoint configuration to an indexed, self-hosted Blockscout instance in minutes. For chain teams, indexing and explorer setup are practical infrastructure tasks: developers need to inspect transactions and contracts, while users need a way to check whether activity has been recorded. The wizard reduces setup steps, though the source provides no performance figures or comparison across different network configurations.
Blockscout also added an optional fee for token submitters who want their information placed earlier in the review queue. The submitted information can include a logo, social links, and metadata. This changes how quickly a submission may be reviewed; it doesn’t, by itself, verify the accuracy of the information or guarantee that a token’s details will be accepted. Users should distinguish displayed metadata from on-chain facts, since descriptive fields and logos are not the same as a contract’s code or transaction history.
What to watch in October
The next scheduled technical milestone listed for October is Ethereum’s Glamsterdam Sepolia fork on October 6, described as the final major testnet step before a Q4 mainnet upgrade. Testnet activity gives developers a place to assess a planned change before it reaches the main network, but a testnet milestone is not the same as a completed mainnet deployment. The details of the upgrade and its eventual timing remain the relevant items to track.
The other open question is whether Bitcoin ETF inflows continue after their record week. September’s figures show a strong burst of demand and a positive year-to-date balance, but one week cannot establish a lasting pattern. For infrastructure teams, the month’s clearest practical signal is more immediate: faster settlement and easier chain access matter, but they do not remove the need to scrutinize wallet operations, asset flows, and the quality of information presented to users.
