Wikibit Crypto Risk Monitor — September 28, 2026

September 28 is primarily an execution-risk day. No newly verified exploit in the latest scan exceeds the security events already under active monitoring, but several exchange users are entering irreversible platform-controlled actions: Bitget is due to test the first phase of its post-hack withdrawal restoration; Kraken starts liquidating four migrated-token balances whose withdrawal windows have already closed; Bitvavo is converting residual KAVA, XNO and RVN to EUR; CoinEx is less than one day from ending spot trading and beginning disposal of non-USDT balances; and BitMEXs live support documentation now describes withdrawals as manual-web-only with USDT, USDC and ETH restricted to Ethereum.

The most important security development remains Bitget. BTC withdrawals are scheduled to reopen at 08:00 UTC on September 28, later than this reports publication cutoff. The exchange says the wallet-backend vulnerability behind the September 24 breach has been remediated and that account balances are unaffected. The first successful BTC withdrawals will therefore be the first externally observable test of the recovery plan, rather than another statement of intent.

At the same time, the attacker‘s assets continue moving. A detailed public chain reconstruction using Bitget’s published attacker addresses found the original stolen XRP had effectively been moved out of the large initial XRP holding accounts by September 27, with much of the traceable flow converted toward Bitcoin through THORChain. At 14:28 UTC on September 27, that reconstruction counted approximately 1,889.58 BTC in attacker-linked holdings and approximately 67,237.94 ETH, while seven of eight large Ethereum holding wallets had not moved. These are on-chain developing snapshots, not Bitget-confirmed recovery or loss figures.

The laundering path has also produced a governance debate. Bitget asked THORChain to reject known attacker addresses; public reports say THORChain declined on the basis that it is permissionless and cannot centrally censor transactions. GoPlus Security separately argued that THORChain validators threshold-signature role means the censorship question is more complicated than it is on Bitcoin or Ethereum. WikiBit does not resolve that governance dispute; the risk fact is that stolen assets have used permissionless cross-chain liquidity to move from more freezeable assets toward Bitcoin.

Read the updated Detail: Bitget Wallet Backend Hack

The clearest forced-execution event today is Krakens liquidation window for legacy Humanity/Beldex assets. Withdrawals for H, HUMANITY, BDX and BELDEX closed on September 25 at 14:00 UTC. Any balances left on Kraken enter automatic liquidation from September 28 through October 2. Kraken explicitly warns that liquidation prices can be far below recent reference prices and that thin liquidity may produce minimal or no proceeds. The denomination of liquidation proceeds is not guaranteed in advance.

These four balances are tied to prior token migrations. HUMANITY is the new token Kraken used to distinguish Humanity‘s replacement H contract from legacy H; BELDEX is Kraken’s ticker for the replacement Beldex token after the BDX incident. The liquidation event is not a fresh hack, but it is a direct consequence of post-incident migration and delisting.

Read the Detail: Kraken Humanity and Beldex Forced Liquidations

Bitvavo reaches a separate forced-conversion step today. KAVA, XNO and RVN deposits, trading and withdrawals were already shut down on September 18. Bitvavo says any residual balances will be automatically converted to EUR on or before September 28. KAVA and RVN holders previously had a withdrawal route; XNO was a trade-only asset on Bitvavo and did not support withdrawal. Users can temporarily see a zero EUR value while Bitvavo completes the sale and credits the proceeds.

Read the Detail: Bitvavo KAVA/XNO/RVN Forced EUR Conversion

The highest-priority shutdown deadline remains CoinEx at September 29, 02:00 UTC. Under the wind-down terms, spot trading ends, unfilled spot orders are cancelled, remaining CET is automatically repurchased at 0.005 USDT per CET, CoinEx Smart Chain and OneSwap cease operations, and CoinEx begins processing remaining non-USDT balances. Users who want non-USDT assets in their original token form need to complete those withdrawals before this deadline. Assets with external liquidity may thereafter be sold and credited as net USDT proceeds; illiquid assets can face delisting and discontinued wallet support. General withdrawals remain open until December 22, but that later date does not preserve the right to receive every asset in original form.

Read the updated Detail: CoinEx Shutdown

Finally, BitMEX‘s current live support page now lists API withdrawals as disabled and says all withdrawals must be submitted manually through the web portal. It also lists USDT, USDC and ETH as Ethereum-only for withdrawal. This matters because the older closure FAQ originally dated those technical changes for September 28 at 04:00 UTC. Following WikiBit’s rule to use the latest operational status rather than an older scheduled description, todays article treats the restrictions as already in effect. Manual web withdrawals remain available, trading is closed, and deposits sent after the September 23 closure are not credited.

Read the updated Detail: BitMEX Shutdown and Current Withdrawal Restrictions

Two other September 28 events remain important but do not receive another Detail because WikiBit already published full pages yesterday and there is no new verified change yet. Binance is scheduled to end Fiat Trade UAH deposits/withdrawals and USDT/UAH trading at 09:00 UTC+2 today, with eligible residual UAH converted at 46.5 UAH per USDT by September 30. Coinbase is scheduled to suspend BADGER and STORJ trading at around 2:00 p.m. ET while keeping withdrawals available.

MEXC also has a planned one-hour EVM withdrawal maintenance window from 04:00 to 05:00 UTC today. Deposits are not affected. WikiBit rates this Low because it is pre-announced network maintenance, not an unexpected withdrawal freeze.

① Todays Highest-Priority Alerts

② Exchange Exit / Shutdown / Withdrawal Risk

Bitget — Critical

Today is the first live test of the post-hack recovery plan.

BTC withdrawals are scheduled for 08:00 UTC. Because this report is published before that time, WikiBit does not claim they are already functioning. The next verification points are:

• withdrawal switch enabled;
• BTC transactions broadcast;
• transactions confirm on-chain;
• throughput remains stable;
• no new emergency pause occurs.

ETH follows September 29, USDT September 30 and other tokens/fiat/P2P October 2.

Kraken — High

H/HUMANITY and BDX/BELDEX holders have passed the withdrawal stage. Kraken now controls execution for residual balances during the September 28–October 2 liquidation period.

This is particularly risky because Kraken warns that some affected markets are thin enough that:

• liquidation may be far below reference prices;
• proceeds may be minimal;
• in extreme cases, proceeds may be zero;
• payout denomination is determined by market conditions.

Bitvavo — Medium

KAVA/XNO/RVN holders who left balances on Bitvavo no longer control execution. The exchange is converting those balances to EUR by today.

XNO users had fewer exit options because XNO was trade-only on Bitvavo and withdrawals were not supported before the delisting.

CoinEx — Critical

The remaining self-directed window for non-USDT original assets ends tomorrow at 02:00 UTC.

The later December 22 withdrawal date is mainly relevant to balances that remain supported through the wind-down; it must not be interpreted as a guarantee that every non-USDT token remains withdrawable unchanged until December.

BitMEX — High

Trading and deposits are over. The current support state says:

• manual web withdrawals only;
• API withdrawals disabled;
• USDT/USDC/ETH Ethereum-only;
• minimum thresholds shown dynamically.

Users should follow the live withdrawal screen rather than older third-party descriptions of the shutdown schedule.

Binance UAH — High

At 09:00 UTC+2 today:

• Fiat Trade UAH deposit/withdrawal support ends;
• USDT/UAH spot trading ends;
• open orders are removed.

Eligible residual UAH is scheduled for automatic conversion by September 30 at 46.5 UAH/USDT.

③ Regulation and Licensing

No new official enforcement action in the last monitoring window exceeds todays exchange-security and hard-deadline events.

Two regulatory deadlines now sit only two days away:

United Kingdom: the FCA cryptoasset authorisation gateway opens at 07:00 UK time on September 30. The application period is expected to run through February 28, 2027. Existing MLR/payment/e-money registrations do not automatically become authorisation under the future regime.

Australia: ASICs sector-wide digital-asset no-action position expires on September 30. ASIC says roughly 30 digital-asset licence applications had been received since October 2025 and the no-action position covers certain firms transitioning toward AFS, market or clearing/settlement licensing.

Neither deadline means every crypto firm becomes illegal on October 1; applicability depends on activities and transitional conditions.

④ Hacks / Vulnerabilities / Asset Loss

Bitget — Critical, containment versus asset recovery

Bitget says the internal vulnerability is remediated. On-chain movement demonstrates that stolen assets are a separate problem.

A public reconstruction based on Bitget-attributed addresses tracked stolen XRP into cross-chain swaps and Bitcoin and found additional ETH beginning to move. Those figures must remain On-chain / Developing because attribution, prices and service labels can evolve.

The core security lesson remains unchanged: key custody can stay intact while a compromised backend falsifies the transaction context presented to the authorization/signing process.

Meter.io — Critical / Continuing

No verified mainnet restart or final recovery state was found in this scan. Meters block-validation incident therefore remains an unresolved chain-integrity event.

Magic Eden / Limit Break — High / Continuing

The recovery site and $2.8M stolen estimate were already captured in yesterdays updated Detail. Wallets that still retain vulnerable approvals remain at risk until those permissions are revoked.

⑤ User Complaints / Operational Anomalies

No new Community-only complaint cluster reached WikiBits platform-wide High/Critical threshold in this run.

The major operational complaints are already backed by official status rather than community reports:

• Bitget withdrawal pause/recovery schedule;
• Kraken platform-controlled liquidation;
• Bitvavo conversion;
• CoinEx shutdown.

Scammers can exploit every one of these deadlines. Any message claiming to provide:

• priority Bitget withdrawal;
• Kraken liquidation reversal;
• CoinEx balance “unlocking”;
• Bitvavo conversion recovery;

must be treated as Community / Unverified unless it is verifiable through the platforms authenticated support channel.

⑥ On-chain and Market Anomalies

Bitget remains todays largest on-chain risk.

A detailed September 27 reconstruction counted attacker-linked holdings at roughly:

• 1,889.58 BTC;
• 67,237.94 ETH;
• 18,669.98 ZEC;
• smaller ALGO/stablecoin/XRP balances;

at the cited snapshot. The same reconstruction found the original large XRP holding accounts had been substantially emptied through repeated cross-chain conversion routes.

These are not “recovered” balances. They are estimates of attacker-linked holdings after swaps.

THORChain has become the central policy flashpoint because known stolen assets can enter permissionless cross-chain liquidity even after addresses are publicly identified. The debate over validator powers does not change the immediate risk: the more assets are converted into BTC and dispersed, the harder issuer-level freezing becomes.

⑦ Watchlist

Date / Window	Event	What WikiBit Is Watching
Sep. 28 04:00–05:00 UTC	MEXC	Planned EVM withdrawal maintenance and timely restoration
Sep. 28 08:00 UTC	Bitget	BTC withdrawal restart, on-chain broadcasts and throughput
Sep. 28 09:00 UTC+2	Binance	Fiat Trade UAH and USDT/UAH closure
Sep. 28 ~2 PM ET	Coinbase	BADGER/STORJ trading suspension
Sep. 28–Oct. 2	Kraken	H/HUMANITY and BDX/BELDEX forced-liquidation execution
By Sep. 28	Bitvavo	KAVA/XNO/RVN residual EUR conversion
Sep. 29 02:00 UTC	CoinEx	Spot shutdown, CET repurchase, non-USDT disposal, CSC/OneSwap closure
Sep. 29 08:00 UTC	Bitget	ETH withdrawal restart
Sep. 30 07:00 UK time	FCA	UK crypto authorisation gateway opens
Sep. 30	ASIC	Australian digital-asset no-action transition expires
Sep. 30 08:00 UTC	Bitget	USDT withdrawal restart
Sep. 30	Router Protocol	Full protocol shutdown target
Oct. 2 08:00 UTC	Bitget	Other tokens / fiat / P2P scheduled restoration
Dec. 22 02:00 UTC	CoinEx	General withdrawal window ends

⑧ No New Development Today, but Still High Risk

Meter.io — Critical: mainnet/bridge recovery method and final exploit-created supply remain unresolved.

Duelbits — High: full platform/withdrawal restoration and root cause remain unresolved in the latest verified reporting.

Payy Network — High: bridge root cause, recovery and normal operations remain unresolved.

DCENT App Wallet — Critical: final root cause and multi-chain loss accounting remain unresolved.

Nostra — Critical: final bad debt, recovery and full money-market reopening remain unresolved.

Neutron — Critical: final Astroport/Drop loss, chain recovery and governance remediation remain unresolved.

Liquid Network — Critical: corrected-chain integrity improved, but the latest official assessment still left approximately 602 BTC outstanding.

BitMart — Critical: no verified recovery percentage or withdrawal timetable in the latest WikiBit monitoring state.

FAQ

Are Bitget BTC withdrawals already open？

Not at this reports publication cutoff. They are scheduled to reopen at 08:00 UTC on September 28 and must be verified in operation.

What is new about the stolen Bitget funds？

On-chain researchers have tracked much of the stolen XRP through cross-chain swap routes toward Bitcoin, while some stolen ETH has also begun moving. These are developing chain-analysis findings.

Which Kraken assets enter forced liquidation today？

Legacy Humanity H, replacement HUMANITY, legacy BDX and replacement BELDEX are scheduled for liquidation from September 28 through October 2 after withdrawals closed September 25.

What happens to KAVA, XNO and RVN left on Bitvavo？

Bitvavo says residual balances will be automatically converted to EUR on or before September 28.

What is the most important CoinEx deadline now？

September 29 at 02:00 UTC if you want non-USDT assets in their original token form. Spot trading also ends then.

Can users still withdraw from BitMEX？

Yes through the web portal. BitMEXs current support page says API withdrawals are disabled and USDT, USDC and ETH are withdrawal-only on Ethereum.