Post-Quantum & Cryptographic Trust

Crypto exchange Bitget announced on its official X account on September 28 that it had resumed Bitcoin withdrawals starting at 5:00 p.m. Japan time. The move is part of a phased restoration of withdrawal services that had been suspended following a security incident confirmed on September 24. The exchange said the vulnerability behind the incident has been fixed, no new unauthorized transfers have been detected since the incident was contained, and user account balances were unaffected. Under the withdrawal resumption schedule, Ethereum withdrawals will resume at 5:00 p.m. on September 29, Tether at 5:00 p.m. on September 30, and other cryptocurrencies, fiat currencies, and P2P-related withdrawals at 5:00 p.m. on October 2. The backdrop is a large-scale asset outflow that occurred on September 24, when the company detected unauthorized asset movements from some of its hot wallets and warm wallets on September 25 and disclosed that about $387.5 million in assets had been moved to addresses controlled by the attacker. An initial investigation found that the attacker breached a key backend system underpinning the wallets, falsified transfer data, and moved the assets, but no evidence was found that the private keys themselves were stolen. The company plans to cover the losses through its user protection fund, which stood at roughly $464 million at the time of the incident, exceeding the amount lost, and users do not need to take any additional steps before withdrawals resume.

Bitget, a major cryptocurrency trading platform, disclosed that digital assets worth about $351.6 million were transferred out of its system without authorization, with preliminary evidence linking the incident to a North Korean hacker group. Bitget CEO Gracy Chen said the investigation team found IP addresses linked to a VPN service previously used by North Korean hackers, as well as attack patterns similar to earlier operations tied to North Korea, though the exact technical method of access is still under review. Bitget detected the unauthorized transfers of digital assets from crypto wallets on the afternoon of Thursday, September 24, U.S. time, totaling 19 transactions from hot wallets and warm wallets, while cold wallets were unaffected. The assets transferred out included ether, XRP, USDT, USDC, AVAX and BNB across multiple networks. An earlier estimate put the losses at about $183 million, but Bitget said that figure did not cover transactions on all affected networks. Bitget's security team found that hackers breached the wallet backend system before falsifying transfer data and prompting the system to sign off on the transactions. The company said it has brought the incident under control and prevented further asset transfers. Chen said the attack was not caused by a private key leak or compromise. Bitget is still temporarily suspending withdrawals to repair and strengthen system security, while deposits and trading remain available as normal. The Bitget CEO has not given a definite timeline for resuming withdrawals, but said it could take only a few hours to a few days and is unlikely to stretch to weeks. The company added that customer asset balances remain accurate and that losses are covered by its user protection fund, which holds more than $464 million.

Apple has asked the Investigatory Powers Tribunal to lift restrictions that bar the Home Office from confirming it secretly ordered the company to build a "backdoor" into iPhones. The US technology giant, joined by human-rights organisations Liberty and Privacy International, argued at a case-management hearing on Thursday that confirming the order's existence would let the legal challenge be heard in public. The Home Office ordered Apple last year to break the encryption protecting iPhone users' iCloud accounts, which hold photos, files, contacts and messages, even when users have enabled the most advanced protection features. Apple has refused, saying it would never build a way to break its own encryption, and has instead removed its "Advanced Data Protection" feature for everyone in Britain. Daniel Beard KC, for Apple, said lifting the restrictions would allow "facts to be deployed in the open"; Ben Jaffey KC, for the campaign groups, called the secrecy "farcical" and the "emperor's new clothes", while Neil Sheldon KC, for Home Secretary Shabana Mahmood, said departures from "neither confirm nor deny" inevitably weaken its effectiveness. The three-person tribunal, led by its president Lady Carmichael, did not rule. The order was first issued early last year by then home secretary Yvette Cooper, dropped under pressure from the Trump administration, and replaced by a second order applying only to people in Britain.

SEALSQ Corp reported a $32.2 million operating loss for the six months ended June 30, 2026, compared with $21.2 million a year earlier, according to full results released September 11. Revenue for the half reached $11.2 million, up 131%, though that figure includes $2.5 million contributed by IC'Alps SAS, so the headline increase reflects acquisition growth as well as organic sales. Gross margin came in at 48.5%, producing $5.4 million of gross profit, while research, selling and administrative expenses totaled $39.0 million before $1.4 million of other operating income, with general and administrative costs alone at $23.1 million. SEALSQ held approximately $479.8 million of unrestricted cash and cash equivalents at June 30, and full-year revenue guidance remains $27 million to $36 million, implying roughly $15.8 million to $24.8 million in second-half sales. Management expects initial QS7001 and QVault TPM commercial revenue toward the end of 2026, with a more significant contribution in 2027 and beyond, subject to certification, customer qualification and procurement timing.

Liquid, a sidechain of Bitcoin, has suspended operations after an actor claiming to be a white-hat hacker withdrew approximately 4,000 bitcoins, worth $320 million, from the network's federation wallet. The withdrawal accounted for about 95% of the roughly 4,200 BTC balance that backed the L-BTC issued on the sidechain. Bridge nodes were disabled, preventing new transactions, while various exchanges suspended deposits and withdrawals of L-BTC. However, other assets such as USDT and DePix were unaffected. Blockstream, Liquid's technology provider, contacted the actor via an on-chain message, with the actor promising to return most of the bitcoins after the vulnerability is fixed and all nodes are patched. As of the time of reporting, no funds had been returned.

Alex Thorn, head of research at Galaxy Digital, said on September 3 that in the security breach involving the hardware wallet COLDCARD, the attacker behind the third wave has moved the stolen bitcoin for the first time. The attacker exchanged part of the stolen funds for Ethereum through THORChain, a cross-chain decentralized exchange (DEX). Moving funds from Bitcoin to Ethereum suggests a possible attempt to launder the money. According to Thorn, this is the first time stolen funds have moved from their original addresses across the series of attacks, which are classified into waves one through three. About 90% of the funds stolen in the third wave remain unmoved at this time. Additionally, although the attacker has faced issues such as some transactions being refunded during the exchange on THORChain, they have repeatedly attempted to exchange the remaining funds. Thorn said he has traced the funds routed through THORChain to new Ethereum addresses and shared that information with relevant authorities and cryptocurrency-related companies. Coinkite, the developer of COLDCARD, disclosed a firmware flaw in seed generation on July 30, and the attacker is believed to have regenerated private keys from weak seeds to steal funds. According to a tally published by Thorn on August 24, a total of 1,789.28 BTC, worth approximately $114.7 million (about 18.4 billion yen) at the time of the theft, was stolen from 8,865 addresses in the series of attacks.

Hackers have stolen $130 million in Bitcoin by exploiting the surprisingly weak security of a popular hardware wallet, raising concerns for Bitcoin investors. The attack targeted Coldcard wallets sold by Canadian company Coinkite, where weak random number generators allowed malicious actors to derive private keys remotely. This incident undermines trust in self-custody and may shift power back to institutions, benefiting spot Bitcoin ETFs. Coinkite has released new firmware to address the vulnerability, but rebuilding trust will be challenging.

Swiss hardware wallet maker BitBox released its latest firmware on August 17, fixing two critical vulnerabilities found during an internal audit. The first was a memory corruption flaw that, when an uninitialized Multi edition device was connected to a malicious host, could allow arbitrary code execution or installation of malicious firmware. The second was a flaw in the Silent Payments implementation that could let a malicious host manipulate transactions and cause funds to be locked to unintended addresses. The company said there have been no reports of fund loss and no impact on users' seeds. It also revealed that a bootloader issue fixed in July was more serious than initially described, and is urging all users to update to the latest version.

Since the start of August, major hardware wallet companies that support self-custody have been hit by a string of disclosed incidents. In Coldcard, made by Canada's Coinkite, flaws in random number generation during key creation made it possible for third parties to recover keys, triggering large-scale fund outflows, with estimated cumulative losses reaching up to about 20 billion yen, or roughly 2,055 Bitcoin. Trezor announced on August 13 that the systems of its shipping contractor ShipMonk had been attacked, leaking order data for about 14,000 people. SafePal disclosed on August 16 that a configuration flaw in the order tracking tool on its official website had left order information for about 40,000 people viewable by third parties. These incidents can be grouped into two categories: decryption and theft of funds caused by flaws in the key generation mechanism, and leaks of customer information through peripheral systems such as e-commerce and shipping, showing that even hardware wallets cannot completely prevent risk.