Exchange Withdrawal News Review — September 28–October 4, 2026

✅1. Bitget completed its restoration calendar on schedule

Oct 2, 08:00 UTC. The final phase of Bitget's withdrawal restoration went ahead as published: all remaining supported tokens, fiat rails and P2P services reopened, completing a calendar that had returned BTC on September 28, ETH on September 29, and USDT on Ethereum, BSC, Solana and TRON on September 30 — all at the advertised 08:00 UTC slots. In an October 2 interview, CEO Gracy Chen confirmed BTC, ETH and USDT withdrawals were operating again and the platform was “gradually returning to normal operations.” Roughly seven and a half days elapsed between detection (September 24, 18:31 UTC) and full restoration.

Why it matters: this site tracks withdrawal availability as closely as fees, and a published calendar that holds is the single most reassuring artifact an incident response can produce. Every one of the four dates Bitget printed on September 26 landed on time.

Takeaway: the $1-floor fee table is whole again — all six venues are operational. If you withdrew or paused activity during the suspension, send a small test transfer before resuming large flows.

Source: Bitget official incident recap — restoration completed October 2, 2026

🔎2. The root-cause reports are out: two third-party security products, and a 24-day head start

Sep 30. Mandiant (part of Google Cloud) and SlowMist published their independent investigation reports. Both point the same direction: attackers compromised third-party security products used by Bitget, which gave them access to the production wallet environment; malicious packages were deployed on wallet infrastructure, and fraudulent withdrawal commands then passed through Bitget's own approval flow. Neither report attributes the attack to a named group. SlowMist's log analysis traced the earliest malicious activity back to August 31 — 24 days before the September 24 detection.

Chen, in the same October 2 interviews, declined to name the affected vendors, saying disclosure beyond the published findings could create new attack surface. The exchange says it is reviewing how it assesses and deploys third-party security products.

Why it matters: the confirmed mechanism — a security vendor's product turned into the entry point — matches the pattern we described in last week's deep dive: attackers stopped attacking the vault and started attacking the tooling that guards it. A 24-day dwell time before detection is the detail that should concern every venue procurement process.

Takeaway: private keys held; the process around them failed. Proof-of-reserves pages do not attest to any of this — which is why restoration speed and calendar discipline are the observable metrics users can actually grade.

Source: Bitget official recap of the Mandiant and SlowMist findings, 2026-09-30

🧮3. The recovery ledger: $387.5 million gone, about $1.1 million frozen

Oct 2. Chen disclosed that only about $1.1 million of the stolen funds has been frozen so far, and said she does not expect a large share to be recovered, citing the industry's track record after comparable thefts. The User Protection Fund — which stood above $464 million before the incident and dipped below $200 million when it absorbed the loss — has been refilled to above $300 million using Bitget's own capital, not recovered funds.

Alongside the fund update, Bitget released a fresh proof-of-reserves snapshot taken September 29: an overall reserve ratio of about 131% across 19 covered assets, all above 100% — Bitcoin at roughly 142%, USDC around 154%, USDT near 107%, ETH about 110%.

Why it matters: these are two different ledgers that should never be conflated. The fund refill is exchange capital replacing stolen assets — a solvency statement. The $1.1 million freeze is the actual recovery scorecard — and it says that once funds cross chains, very little comes back.

Takeaway: the loss was real, the coverage was real, and the recovery rate so far is under 0.3%. Depositor protection worked exactly as designed — through the fund, not through retrieval.

Source: Gracy Chen interview via Sina Finance / European Financial Forum, 2026-10-02 · Bitget official recap — PoR 131%, fund refill, 2026-09-29/30

🔀4. Following the money: one router converted, two refused

Sep 29–30. The laundering split told the week's clearest story about chain-level freeze power. An attacker-linked wallet converted roughly $6.3 million of ETH into 75.2 BTC through THORChain after Bitget asked the network to block it. NEAR Intents, by contrast, said it stopped more than $50 million of related cross-chain transfers. And per MistTrack's tracing, a transfer routed through the Chainflip protocol was refused at the broker interface and bounced back to the attacker's own address — not frozen, simply declined.

Earlier, about $83 million of stolen XRP had already moved — an asset with no issuer freeze mechanism at all.

Why it matters: three cross-chain protocols, three different answers to the same request. Where an intermediary controls a chokepoint, stolen funds stall; where liquidity is permissionless, they flow. For stablecoin users this is the same trade-off we described in the Tether freeze leg last week, viewed from the other side.

Takeaway: freeze-ability is not recoverability — and neither is blockability. The attacker needs only one permissive route; defenders need all of them.

Source: Crypto Briefing — THORChain conversion and NEAR Intents blocking, 2026-09-29 · MistTrack (SlowMist) tracing update — Chainflip deposit refused and returned, 2026-09-30

🚪5. CoinEx crossed into its withdrawal-only phase

Sep 29. The CoinEx wind-down passed the milestone last week's coverage flagged as the real deadline for non-USDT balances: all spot trading ceased, unfilled orders were cancelled, and the platform began converting remaining non-USDT balances — liquid assets sold externally and credited in USDT, illiquid ones delisted with wallets no longer maintained. The CET repurchase window closed the same day: coins still in accounts were automatically bought back at 0.005 USDT, and the repurchase channel is now permanently shut. CoinEx Smart Chain and OneSwap ceased operating, and the cross-chain bridge redemption window closed with them.

What remains is a withdrawal pipe: USDT balances can leave until December 22, 02:00 UTC, after which unwithdrawn funds move to independent custody under a 5% monthly fee on the recorded balance.

Why it matters: the December deadline is now the only exit. Every week of delay costs nothing in USDT terms until December — but the 5% monthly clock starts the day after, compounding at roughly 46% a year.

Takeaway: if you still hold anything on CoinEx, the calendar arithmetic has not changed: 84 days to December 22, and no reason to use more than a few of them.

Source: CoinEx official cessation notice — withdrawal deadline and asset disposal terms

💀6. Blast is shutting down — and gave users 24 days to leave

Oct 2. Blast — the Ethereum layer-2 built by the Blur founder, backed by $20 million from Paradigm and Standard Crypto, and once valued around $2.3 billion after attracting over $1.1 billion in deposits before launch — announced it is winding down. The stated reason is blunt: “the ongoing costs of maintaining Blast exceed the revenue generated by the L2, and we do not see a credible path to making the chain economically sustainable.” Total assets on the network are down about 98% from their peak.

The exit mechanics matter more than the epitaph. Withdrawals are paused for roughly a week while the team unwinds Blast's Lido positions; after that, the withdrawal delay drops to 24 hours. Users have until October 26, 2026 to withdraw through the normal interface — after that, assets remain recoverable only by interacting directly with Blast's bridge contracts on Ethereum L1.

Why it matters: this is the CoinEx pattern showing up outside the exchange sector — a dated withdrawal window, a hard deadline after which the friendly interface closes, and a fallback that requires technical confidence most users do not have. We flagged in July that exchange shutdowns had become a recurring withdrawal-risk category; infrastructure is now supplying the same lesson.

Takeaway: a deadline with a contract-address exit after it is a deadline. Treat October 26 the way CoinEx users should treat December 22.

Source: crypto.news — Blast shutdown announcement and withdrawal terms, 2026-10-02/03

📊7. The jobs report collapsed October rate-hike odds from 64% to 18%

Oct 2. The US September employment report came in at +29,000 jobs against forecasts in the mid-80,000s — the third-weakest print of 2026 — with unemployment rising to 4.2% and August revised down to 133,000. Markets read it as the end of the tightening cycle's momentum: CME FedWatch pricing for an October 25-basis-point hike collapsed from roughly two-thirds a week earlier to under 20%. The 10-year Treasury yield whipsawed on the jobs day — dipping to 5.18% before rebounding above 5.28% — after touching its highest levels since the early 2000s earlier in the week.

Context from last month: the Federal Reserve raised rates 25 basis points on September 16 to 3.75–4.00% — its first hike since July 2023 — which is why the October meeting's odds mattered enough to move everything.

Why it matters: withdrawal fees do not react to macro, but the dollar cost of holding and moving crypto does — through stablecoin flows, exchange liquidity and the risk appetite that determines whether people are moving funds at all.

Takeaway: the tightening trade that pushed yields to multi-decade highs lost its momentum this week. The next scheduled macro tests are FOMC minutes on October 7 and September CPI on October 13.

Source: CoinMarketCap market wrap — payrolls, FedWatch odds and yields, 2026-10-02

📈8. Bitcoin spiked to $87,200 on the jobs print — then gave it back within a day

Oct 2–3. Bitcoin tagged an intraday high of about $87,200 in the New York session after the jobs data — its strongest level since January — and then reversed hard into the close near $84,500 as the 10-year yield rebounded to 5.28%. The fade continued into Saturday: about $433.6 million of leveraged positions were liquidated on October 3, of which roughly $321.8 million (74%) were longs. By October 4 bitcoin sat near $84,800–85,000, leaving the week up about 0.4% overall. September had closed with a +6.3% monthly gain.

Resistance structure mattered: Glassnode observed the sell wall clustered around $85,000 partly filled and partly withdrawn as buyers pushed through — clearing the path — with a smaller concentration of asks forming around $87,000.

Why it matters: a spike-and-fade week is exactly when withdrawal queues and settlement timing matter most — users moving during the $87,000 window and the Saturday unwind experienced materially different fills within 48 hours.

Takeaway: the week's range — roughly $82,600 to $87,200 — was wide enough that when you moved funds mattered as much as where from.

Source: CoinMarketCap BTC daily history, 2026-09-28 – 10-04 · CoinGlass liquidation data via The Crypto Times, 2026-10-03

🎰9. ETF demand cooled hard: $241 million in, after $2.39 billion the week before

Sep 28 – Oct 2. US spot Bitcoin ETFs took in a net $241.1 million for the week — a sharp brake after the prior week's $2.39 billion, the best of 2026. The daily sequence: +$31.1M Monday, +$66.2M Tuesday, -$148.7M Wednesday (ending a nine-day inflow streak), +$102.7M Thursday, +$189.8M Friday. Concentration was extreme: BlackRock's IBIT drew roughly $450 million for the week while Fidelity's FBTC bled $167.9 million. Ethereum ETFs posted net outflows of $138 million. Two firsts on the alt side: Zcash ETFs recorded their first-ever outflow week (about -$94 million) and NEAR ETFs debuted with +$36.0 million. September's monthly Bitcoin ETF take ran roughly $2.6–2.9 billion depending on the dataset. (Note: some tallies published over the weekend showed a far smaller weekly total because Friday's flows had not been fully reported at the time.)

Why it matters: ETF flows are the marginal buyer whose behavior shapes the liquidity environment every withdrawal ultimately settles into. A 10x drop in weekly net demand is a regime change in that variable — even with the price itself flat.

Takeaway: flows, not price, were the week's signal. Fee tables do not care; exit liquidity does.

Source: SoSoValue weekly flow data via Blockonomi/CoinMarketCap, 2026-10-05

🔐10. MetaMask exited Ethereum validators after a security incident

Oct 1. MetaMask disclosed an ongoing security incident affecting its Ethereum validators and began emergency exits from the affected positions, working with Lido. Both stressed that end-user wallets are not under immediate threat; the cost lands as forgone staking rewards and possible downtime penalties on the validator side.

Why it matters: the same week Bitget's root cause landed on compromised third-party security tooling, a major self-custody brand was pulling its own infrastructure out of consensus participation — as a precaution. The theme — the tooling around the keys is the attack surface — is now industry-wide.

Takeaway: for withdrawal purposes, nothing changes on TRON: the incident concerns Ethereum validators, not wallet keys. But “verified infrastructure” now needs to be read as a claim with a shelf life.

Source: Lido governance — MetaMask Staking precautionary exits disclosure, 2026-10-01

⚖️11. Banking trade groups sued the OCC over crypto trust charters

Oct 2. The Independent Community Bankers of America (ICBA) — the main trade group for community banks — filed suit against the Office of the Comptroller of the Currency in the US District Court for the District of Columbia, challenging a March 2026 rule that opened national trust charters to non-fiduciary crypto firms. ICBA argues the charters exceed the National Bank Act's grant of authority and let crypto custodians sidestep obligations that bind community banks — an escalation of the institutional fight over crypto's access to the federal banking system. The suit lands as MiCA's full application deadline approaches in Europe, keeping the two largest markets' regulatory trajectories pointed in opposite directions.

Why it matters: charter access determines which US venues can offer fiduciary-grade custody — the product that most directly substitutes for exchange counterparty risk. Slower charter issuance keeps more user assets on trading venues, which is where this site's whole subject matter lives.

Takeaway: the structural answer to withdrawal risk — regulated custody alternatives — is being litigated, not just built.

Source: Reuters — ICBA v. OCC filing, 2026-10-02

⚡12. TRON: the staked-TRX ETF rang the Cboe closing bell; TRON DAO took compliance messaging to INTERPOL

Sep 29 / Oct 2. Two official TRON DAO items this week. On September 29, TRON DAO celebrated the Canary Staked TRX ETF (TRXS) debut with a closing bell ceremony at Cboe in Chicago — the institutional-distribution story that has run through three straight weeks of our coverage. On October 2, TRON DAO reported participation in the INTERPOL NTF, covering compliance frameworks, quantum readiness and law-enforcement dialogue — the network's continuing effort to look like infrastructure regulators can work with.

Why it matters: neither item moves a fee parameter, and neither was expected to. They matter because the withdrawal rail this site tracks is only as durable as the network's institutional standing — and this week's evidence points in one direction.

Takeaway: distribution up (ETF ceremony), compliance engagement up (INTERPOL), and the burn price still 100 SUN — a seventh week of unchanged transfer economics.

Source: TRON DAO news — TRXS Cboe closing bell (2026-09-29); INTERPOL NTF participation (2026-10-02)

📋13. The data week: stablecoins at $312 billion, TRX up 0.7%, fees flat for a seventh week

Oct 4. Dollar stablecoin supply held around $312 billion (DefiLlama-based readings), up roughly 0.6% on seven days — USDT near $184 billion and USDC near $74 billion, with the category still below its May 17 record of about $320.8 billion. TRX closed the week at about $0.3357, up 0.7%, with its intraday high (~$0.341) landing on September 30 — the day Bitget's USDT withdrawals resumed on TRON. Our 11-exchange fee survey did not move for a seventh consecutive week.

Why it matters: the stablecoin base growing while ETF demand cools is the divergence that matters for TRON's rail: settlement demand is holding up even as speculative flows pause.

Takeaway: flat fees, growing floats, and a week with zero cost surprises — after two weeks when the surprises were all availability-side.

Source: Token Recon — DefiLlama stablecoin supply, 2026-10-04 · FXEmpire TRX daily history, 2026-09-28 – 10-04