September 30 is unusually broad. The highest-priority new security event is not a large treasury drain but a transaction-privacy failure at Relay that exposed pending cross-chain order information and allowed MEV searchers to trade around user orders. Relay says approximately 5,600 users were affected between September 12 and September 26, with most activity concentrated from September 23 to September 26. Searchers generated approximately $136,000 in profit; the median impact per affected user was $11.88. Relay plans to reimburse affected wallets automatically for approximately $312,000 in total and paid Outputlayer a $50,000 bug bounty for reporting the issue.
The incident matters because it sits between “smart-contract exploit” and “normal MEV.” The vulnerable surface was the API / pre-execution information path: pending transaction and routing state became visible before execution, allowing searchers to infer intended routes and front-run or sandwich users. Protecting the contract itself was insufficient if information leaked elsewhere in the execution pipeline.
Read the Detail: Relay API Sandwich-Attack Incident
Bitgets operational recovery has advanced again. After BTC withdrawals reopened September 28, Bitget confirmed ETH withdrawals reopened at 08:00 UTC on September 29 across Ethereum, BSC, Arbitrum One, Base and Optimism. Bitget reported that the first hour after ETH reopening produced approximately 9,674 ETH of inflows and 9,023 ETH of outflows, a net inflow of about 651 ETH; this is an exchange-reported operating snapshot, not an independent reserve audit.
The stolen-fund track remains active. NEAR Intents says Bitget-linked attackers attempted more than $50 million of transfers through its service. Its SHIELD controls stopped most attempts, held approximately $503,000 pending legal/recovery procedures and allowed about $166,000 through. The larger $50 million figure represents attempted volume, not recovered funds. The episode contrasts with THORChains refusal to selectively block identified attacker addresses and shows that “permissionless” cross-chain infrastructure can implement very different transaction-screening policies.
USDT withdrawals on Bitget are scheduled for 08:00 UTC on September 30, later than this reports publication cutoff. WikiBit therefore does not claim USDT withdrawal restoration is complete yet.
Read the updated Detail: Bitget Wallet Backend Hack
The UK reaches a major regulatory transition today. The FCAs cryptoasset authorisation gateway is scheduled to open at 07:00 UK time on September 30. Firms intending to conduct newly regulated cryptoasset activities under the future FSMA regime can apply for authorisation or vary existing permissions. The application period runs through February 28, 2027, while the new regime is expected to commence on October 25, 2027. Existing MLR registration, payment-service authorisation or e-money authorisation does not automatically convert into permission for the new regulated cryptoasset activities.
Read the Detail: UK FCA Crypto Authorisation Gateway
Australia reaches a separate hard transition. September 30 is the final day of ASIC‘s sector-wide no-action position for digital-asset businesses that need relevant financial-services licensing. ASIC’s latest reminder says firms that require an AFS licence or variation and fail to satisfy the transition conditions risk operating in breach of financial-services law from October 1, including potential civil and criminal penalties and fines that can reach 10% of annual turnover in applicable cases. ASIC says more than 45 licence applications have been recorded since its updated digital-asset guidance in October 2025.
Read the Detail: Australia ASIC Digital-Asset Licensing Deadline
Router Protocol reaches its announced full-shutdown target today. The project said it would cease all remaining operations by September 30 after commercialization, licensing and acquisition efforts failed to produce a sustainable path. Router plans to permanently burn 303,333,198 ROUTE held in treasury, stop new ROUTE initiatives and open-source selected technology. At this reports cutoff, WikiBit has not independently verified execution of the treasury burn or every service shutdown, so the status remains Shutdown Target Today / Execution Verification Pending, not “all Router infrastructure is already offline.”
Read the updated Detail: Router Protocol Shutdown
The ICON / ICX → SODA migration also enters a concentrated exchange-access phase today. The ICON Foundations latest migration notice moved the two-way conversion cutoff forward from September 30 to September 25 because of tighter technical/security requirements and thinning ICX liquidity. Only ICX → SODA migration now remains, with a final migration/network-shutdown deadline of December 31, 2026. Separately, Bitrue ends ICX/USDT, ICX/XRP and ICX/BTC trading at 06:00 UTC on September 30 and keeps withdrawals open until October 30, while explicitly stating that it will not perform the ICX→SODA swap for users. OKX TR removes ICX/USDC and ICX/EUR between 08:00 and 10:00 UTC today, with ICX/USDT following October 3.
Read the Detail: ICON ICX to SODA Migration and Exchange Delistings
Finally, U.S. congressional scrutiny of crypto-linked trading venues widened on September 29. House Oversight Chairman James Comer requested records from Hyperliquid Labs, Crypto.com and Aristotle Exchange/PredictIt covering identity verification, suspicious-trade surveillance and referrals to regulators/law enforcement. Reporting on the letters says the committee cited a very large leveraged Hyperliquid short opened shortly before an October 2025 tariff announcement, but the inquiry does not establish that the trader possessed nonpublic information or that Hyperliquid facilitated insider trading. Responses are reportedly requested by October 13.
Read the Detail: U.S. House Prediction-Market and Hyperliquid Probe
CoinEx has now passed its September 29 spot-trading/original-form non-USDT deadline under the published shutdown plan. General withdrawals remain scheduled through December 22, but the exchange may already be processing residual non-USDT balances into USDT or discontinuing support for illiquid assets. No sufficiently authoritative post-deadline execution report was found in this scan to quantify actual conversion outcomes, so WikiBit does not invent one.
① Todays Highest-Priority Alerts
Relay
- Risk:High
- Event: API exposure / sandwich attacks
- Time: Disclosed Sep. 29; activity Sep. 12–26
- Latest Status: ~5,600 users affected; ~$136K searcher profit; ~$312K automatic reimbursement planned; issue reported by Outputlayer
- Evidence Type: Project / Media / MEV analysis
- Continue Monitoring:Yes
- New vs Previous Day:New security incident disclosed after prior-day cutoff
Bitget
- Risk:Critical
- Event: Post-hack withdrawal restoration + laundering controls
- Time: Sep. 29–30
- Latest Status: ETH withdrawals confirmed open; first-hour net inflow reported; USDT scheduled Sep. 30 08:00 UTC; NEAR Intents held ~$503K of attacker-linked swaps
- Evidence Type: Official + On-chain + Media
- Continue Monitoring:Yes
- New vs Previous Day:ETH recovery confirmed + new cross-chain freeze data
UK FCA
- Risk:High
- Event: Cryptoasset authorisation gateway
- Time: Sep. 30 07:00 UK time
- Latest Status: Gateway scheduled to open today; application period to Feb. 28, 2027; old registrations do not auto-convert
- Evidence Type: Official
- Continue Monitoring:Yes
- New vs Previous Day:Major regulatory application window begins today
Australia ASIC
- Risk:High
- Event: Digital-asset licensing transition
- Time: Sep. 30 / Oct. 1
- Latest Status: No-action position ends today; non-compliant in-scope firms risk enforcement from Oct. 1
- Evidence Type: Official
- Continue Monitoring:Yes
- New vs Previous Day:Final transition day
Router Protocol
- Risk:High
- Event: Full shutdown target
- Time: Sep. 30
- Latest Status: Full operational cessation targeted today; 303,333,198 treasury ROUTE burn planned but execution not yet verified at cutoff
- Evidence Type: Project / Media
- Continue Monitoring:Yes
- New vs Previous Day:Shutdown date reached
ICON / ICX / SODA
- Risk:High
- Event: Migration + CEX delistings
- Time: Sep. 30
- Latest Status: Migration already one-way; Bitrue trading closes 06:00 UTC; OKX TR ICX/USDC/EUR closes 08:00–10:00 UTC
- Evidence Type: Project + Official exchanges
- Continue Monitoring:Yes
- New vs Previous Day:New Bitrue delisting + concentrated access loss today
Hyperliquid / Crypto.com / PredictIt
- Risk:Medium / High
- Event: House insider-trading controls inquiry
- Time: Sep. 29; response due Oct. 13
- Latest Status: House Oversight requests KYC/surveillance records; no wrongdoing finding
- Evidence Type: Congressional inquiry reported by major media
- Continue Monitoring:Yes
- New vs Previous Day:New U.S. congressional scrutiny
CoinEx
- Risk:Critical
- Event: Post-spot-shutdown asset disposal
- Time: Since Sep. 29 02:00 UTC
- Latest Status: Published original-form deadline has passed; general withdrawals remain to Dec. 22; actual disposal outcomes not yet independently quantified
- Evidence Type: Official wind-down terms
- Continue Monitoring:Yes
- New vs Previous Day:Moves from pre-deadline to post-deadline phase
② Exchange Exit / Shutdown / Withdrawal Risk
Bitget — Critical, improving
BTC and ETH withdrawals are now confirmed restored in the first two phases.
The next planned milestone is USDT at 08:00 UTC today on Ethereum, BSC, Solana and Tron. This report is issued before that time.
The first-hour ETH flow reported by Bitget is encouraging operationally, but it does not substitute for a Proof-of-Reserves update or complete forensic accounting.
CoinEx — Critical / Post-deadline
The September 29 original-form non-USDT deadline has passed under the published schedule.
From this stage, CoinEx can dispose of externally liquid non-USDT assets and credit net proceeds in USDT. Illiquid assets can face discontinued wallet support. General withdrawals remain scheduled until December 22.
The important status today is loss of user-directed original-asset execution, not the final closure of every withdrawal function.
Bitrue ICX — High
ICX deposits are already closed. Trading ends at 06:00 UTC today. Withdrawals continue to October 30.
Bitrue explicitly says it will not perform the ICX→SODA migration. Users who want SODA must withdraw ICX and use the projects migration process before December 31.
OKX TR ICX — High
ICX/USDC and ICX/EUR are scheduled to delist between 08:00 and 10:00 UTC. ICX/USDT remains until October 3. Withdrawals remain scheduled until December 23.
Router Protocol — High
Protocol operations are targeted to cease today, but CEX ROUTE withdrawal/trading deadlines remain exchange-specific. “Router shuts today” is not equivalent to a universal exchange withdrawal deadline.
③ Regulation and Licensing
UK FCA — High
The authorisation gateway is the most important UK crypto regulatory milestone today.
Firms carrying out future regulated activities such as:
- operating crypto trading platforms;
- safeguarding cryptoassets;
- dealing/arranging;
- qualifying stablecoin issuance;
- certain staking arrangements;
may need FCA authorisation under the future FSMA regime.
The regime itself is expected to start October 25, 2027, not today.
Australia ASIC — High
September 30 is the transition deadline, not a new statute suddenly taking effect.
ASICs position is that existing financial-product definitions already capture some digital-asset businesses. The no-action position provided time for in-scope firms to apply or vary licences.
From October 1, firms that actually require licensing but did not meet the transition conditions can face enforcement exposure.
U.S. House inquiry — Medium / High
The House inquiry broadens the prediction-market insider-trading investigation beyond Polymarket and Kalshi.
Hyperliquid is especially relevant because it is a decentralized/perpetuals venue rather than a conventional prediction market. The inquiry demonstrates that congressional surveillance concerns can extend to crypto derivatives when trades appear connected to nonpublic government decisions.
No allegation in the letters is a final finding of insider trading.
④ Hacks / Vulnerabilities / Asset Loss
Relay — High
Relays API leaked information before transactions executed.
That allowed MEV searchers to infer:
- intended route;
- pending execution state;
- timing;
and trade around users.
The incident is a reminder that cross-chain execution security includes:
- API privacy;
- route privacy;
- mempool handling;
- auction participants;
- solver/provider data boundaries;
not just smart-contract correctness.
Bitget — Critical / Recovery
ETH withdrawals are restored, but stolen-fund recovery continues.
NEAR Intents says >$50M of attacker-linked transfer attempts touched its system; only ~$503K was actually held and ~$166K passed through. Most rejected funds reportedly moved elsewhere.
These figures show that a screening layer can block a specific service interaction without freezing an attackers underlying wallet.
Meter / Liquid / Neutron — Continuing
No new verified material update exceeded existing WikiBit reporting thresholds in this run. Their unresolved loss/recovery issues remain in the stock-risk section.
⑤ User Complaints / Operational Anomalies
No new Community-only complaint cluster reached the threshold for a standalone page.
The largest user-error risks today are transition scams:
- fake Relay compensation claims—Relay says reimbursement is automatic and no application is required;
- fake ICX→SODA migration sites;
- fake FCA “authorisation fee” outreach;
- fake ASIC licensing intermediaries;
- fake ROUTE redemption/compensation offers.
Any message asking for a seed phrase or private key remains Community / Unverified / High Risk.
⑥ On-chain and Market Anomalies
Relays incident is primarily an execution-order anomaly rather than a treasury drain. Searchers extracted value by seeing or inferring transaction intent before users obtained final execution.
Bitgets laundering path remains the largest active on-chain crime-monitoring case. NEAR Intents and THORChain now provide a useful contrast:
- NEAR Intents uses a screening/control layer that can hold suspicious swaps;
- THORChain has rejected selective blacklisting in the Bitget case.
ICX faces a different market-structure anomaly: exchange support is contracting while the underlying network itself is in planned retirement. Liquidity can therefore deteriorate faster than the formal December 31 migration deadline suggests.
⑦ Watchlist
Sep. 30 06:00 UTC — Bitrue / ICX
- Date / Window:Sep. 30 06:00 UTC
- What WikiBit Is Watching: ICX/USDT, ICX/XRP, ICX/BTC trading closure
Sep. 30 07:00 UK time — FCA
- Date / Window:Sep. 30 07:00 UK time
- What WikiBit Is Watching: Crypto authorisation gateway actually opens
Sep. 30 08:00 UTC — Bitget
- Date / Window:Sep. 30 08:00 UTC
- What WikiBit Is Watching: USDT withdrawal restoration
Sep. 30 08:00–10:00 UTC — OKX TR
- Date / Window:Sep. 30 08:00–10:00 UTC
- What WikiBit Is Watching: ICX/STORJ/ELF USDC/EUR pair delistings
Sep. 30 — ASIC
- Date / Window:Sep. 30
- What WikiBit Is Watching: Last day of sector-wide no-action position
Sep. 30 — Router Protocol
- Date / Window:Sep. 30
- What WikiBit Is Watching: Shutdown and treasury-burn execution verification
Sep. 30 17:00 UTC — Binance / Base
- Date / Window:Sep. 30 17:00 UTC
- What WikiBit Is Watching: Base deposits/withdrawals scheduled to pause
Sep. 30 18:00 UTC — Base
- Date / Window:Sep. 30 18:00 UTC
- What WikiBit Is Watching: Cobalt mainnet upgrade
Oct. 2 08:00 UTC — Bitget
- Date / Window:Oct. 2 08:00 UTC
- What WikiBit Is Watching: Other token / fiat / P2P restoration
Oct. 3 08:00–10:00 UTC — OKX TR
- Date / Window:Oct. 3 08:00–10:00 UTC
- What WikiBit Is Watching: ICX/DORA/STORJ/ZEUS/ELF USDT pair delistings
Oct. 13 — U.S. House probe
- Date / Window:Oct. 13
- What WikiBit Is Watching: Requested response deadline for Hyperliquid/Crypto.com/PredictIt materials
Oct. 30 — Bitrue / ICX
- Date / Window:Oct. 30
- What WikiBit Is Watching: ICX withdrawal deadline
Dec. 22 02:00 UTC — CoinEx
- Date / Window:Dec. 22 02:00 UTC
- What WikiBit Is Watching: General withdrawal window ends
Dec. 31 — ICON
- Date / Window:Dec. 31
- What WikiBit Is Watching: Final ICX→SODA migration deadline and ICON Network shutdown
⑧ No New Development Today, but Still High Risk
Meter.io — Critical: final chain restart/recovery method and unbacked supply accounting remain unresolved.
Duelbits — High: final root cause and independently verified full withdrawal recovery remain unresolved.
Payy Network — High: bridge root cause and final recovery remain unresolved.
DCENT App Wallet — Critical: final root cause and multi-chain loss accounting remain unresolved.
Nostra — Critical: final bad debt, recovery and full money-market reopening remain unresolved.
Neutron — Critical: final Astroport/Drop loss and governance remediation remain unresolved.
Liquid Network — Critical: corrected-chain integrity improved, but approximately 602 BTC remained outstanding in the latest official assessment.
Limit Break / Magic Eden — High: recovery is active, but wallets with unrevoked legacy approvals remain exposed.
BitMart — Critical: no verified recovery percentage or withdrawal timetable in the latest WikiBit monitoring state.
FAQ
What is the biggest new security event today？
Relays API exposure, because it affected about 5,600 users by leaking pre-execution transaction information that enabled sandwich/front-running behavior.
Is Relay asking users to claim reimbursement？
No. Relay says approximately $312,000 of compensation will be sent automatically to affected wallets.
Are Bitget ETH withdrawals open？
Yes. Bitget confirmed ETH withdrawals reopened at 08:00 UTC on September 29 across Ethereum, BSC, Arbitrum One, Base and Optimism.
Does the FCAs new crypto regime start today？
No. The authorisation application gateway opens today; the new regime is expected to commence October 25, 2027.
Is September 30 the final ICX migration deadline？
No. Two-way migration already ended September 25. One-way ICX→SODA migration continues until December 31, when ICON Network is scheduled to shut down.
Has Router Protocol definitely completed its burn？
Not at this reports cutoff. The project targeted full shutdown and a 303,333,198 ROUTE treasury burn by September 30, but execution still requires verification.