Daily Brief: September 25, 2026
Security, Stablecoins, Courts, and Bitcoin Momentum
TL;DR: This week underscores three clear trends. First, social engineering is the dominant attack vector, shown by a major Coinbase phishing sentencing and large user losses. Second, operational custody failures still bite, with Bitget losing roughly $352M from hot and warm wallets and highlighting hot wallet risk and recovery challenges. Third, regulation is crystallizing: the Fed proposed strict bank-backed stablecoin rules that limit broad yields and force dollar-backed reserves, while New York sued Polymarket to test state gambling law versus federal oversight. On markets, Bitcoin crossed a key 365-day moving average, offering a cautiously bullish technical signal if shorter-term support holds. These stories point to maturing market structure, tougher legal tests, and the need to fix basic operational risks.
Market Overview
𧊠Socialâengineering scams: sentencing spotlight
A 23âyearâold in Brooklyn was sentenced to four to 12 years after a scheme that convinced nearly 100 Coinbase users to move assets to attackerâcontrolled wallets. Sentenced to prison and ordered to forfeit cash and crypto.
The operation relied on social engineering, spoofed support calls, and urgent prompts to get seed phrases or transfers. Victims lost up to roughly $1 million each, and the attacker pleaded guilty to 31 counts.
Investigators traced funds through swaps, exchanges, gambling platforms, and mixers before partial recovery. Authorities ordered nearly $16M restitution, though full asset recovery remains uncertain.
Why it matters: This sentencing shows that socialâengineering is the main attack surface now, so better user verification, clearer support flows, and education are essential to protect individual holders.
đ Bitget $352M breach raises exchange wallet risk
Bitget says about $351.6M moved from hot and warm wallets, triggering an emergency and paused withdrawals while investigations begin.
On-chain trackers show rapid multi-chain sweeps into a single address, a pattern we've seen in major exchange breaches and large internal sweeps alike.
Bitget says cold wallets stayed secure and its >$464M User Protection Fund covers losses, so customer balances remain intact for now.
Leadership points to traces similar to past state-linked ops, citing IP clues that they say look like the North Korean team, and law enforcement is involved.
Why it matters: This matters because hot-wallet exposure and operational gaps still drive large losses, so exchanges, auditors, and users must treat custody practices as a primary risk, not an afterthought.
đ§ Fed lays out rules for GENIUS Act stablecoins
The Fed proposed rules that force bank-backed stablecoins to hold one dollar of permissible reserves per token and allow redemptions within two business days. It also sets tiered capital charges to cover operational risk.
A companion rule creates a path for Fed-supervised banks to issue stablecoins through subsidiaries, with a 120-day decision clock once an application is complete. Monthly audited disclosures are required.
The Fed limits broad yield on stablecoins but leaves room for small rewards similar to card incentives. Public comments are open for 60 days and will shape the final regs.
Why it matters: These rules would make bank-issued stablecoins more predictable and safer for payments, while shaping which firms can compete and how token rewards work in a regulated system.
âď¸ NY sues Polymarket over prediction markets
New Yorkâs attorney general says Polymarketâs U.S. app is running illegal gambling by offering sports event contracts and is seeking to block New Yorkers from the platform.
The suit presses a deeper question: does federal regulation of certain exchanges exempt them from state gambling laws, or can states still enforce their own rules against prediction markets?
NY wants restitution, user refunds and triple damages, and flags age-compliance and access risks for residents â a ruling could reshape how prediction markets operate in the U.S.
Why it matters: This case will test whether federal oversight can shield platforms from state gambling laws, and the decision will matter for access, liability, and how firms design U.S. offerings.
đ Bitcoin clears 365âday line
Bitcoin nudged above the 365-day moving average after 310 days below it, trading near $82,900. This move looks like the kind that preceded decent 12-month gains in past cycles, but itâs only a signal, not a promise.
That optimism relies on a simple condition: stay above the 200-day average. Analysts point out the 365-day reads lag price, so the real test is whether the 200-day support holds and keeps the trend constructive.
Price dipped briefly about 3% then resumed momentum. Pair this with a recent golden cross and you get a cleaner, if still imperfect, technical backdrop. Expect more tests before conviction grows.
Why it matters: Signals like the 365-day breakout help us weigh risk versus reward: if Bitcoin can hold higher moving averages, institutional and product flows are likelier to follow and that shapes the next leg of adoption.
