Ledgers Academy Letter
The Quiet Ledger: Issue #7 | 25 September 2026
The largest exchange theft of 2026 landed in the same week US spot bitcoin funds took about $2.4 billion and flipped the year's flows positive. The price ignored both and traded a Monday short squeeze instead, because the money arriving now never touches an exchange hot wallet.
Subject: The year's biggest exchange theft landed in the year's biggest ETF week
Preview: Bitget lost about $351.6 million on Thursday. By Friday the US spot bitcoin funds had taken $2.4 billion and flipped 2026 flows positive. The money arriving now never touches an exchange hot wallet.
THE QUIET LEDGER
Issue #7 | Saturday 19 September to Friday 25 September 2026
The largest centralised exchange theft of the year happened in the same week that American spot bitcoin funds recorded their strongest inflows since October 2025, and the price ignored both in favour of a Monday short squeeze
Reporting window Saturday 19 September to Friday 25 September 2026. Data cutoff at the close of Friday 25 September (23:59 UTC, 01:59 Europe/Stockholm on Saturday). Friday was a completed US session, so this week's ETF figures are final rather than pending. Loss figures from the Bitget incident remain provisional while the investigation is open.
Three things happened this week that would each normally define it. An exchange that invented the dominant crypto derivative closed its doors. Another exchange lost roughly a third of a billion dollars out of its wallets. And the American spot bitcoin funds took in about $2.4 billion, enough to turn the entire year's net flows positive for the first time. The price responded to none of them. It responded to a Monday squeeze in the futures market, then spent the rest of the week drifting lower. The pattern worth taking away is that the marginal dollar buying bitcoin in September 2026 arrives through a wrapper that never touches an exchange hot wallet, so news about exchange custody has stopped being news about demand.
1. The Macro Pulse
- Bitcoin: $84,076 at Friday's close, up about 3.9 percent on the week, after touching $86,597 at Tuesday's open and an intraday high above $87,000 on Monday.
- Ether: $2,691 at Friday's close, up about 3.0 percent on the week, with no equivalent spike.
- Fear and Greed: 71, Greed, up 15 points from 56 the previous Friday, having peaked at 78 on Tuesday. That was the only Extreme Greed reading of the run.
- US spot bitcoin ETFs: about $2.4 billion in across five completed sessions, the largest week since the week of 10 October 2025, with BlackRock's IBIT taking about $1.2 billion and Fidelity's FBTC about $701.7 million.
- Liquidations: above $1 billion in the 24 hours around Monday, roughly $878 million of it short positions, on CoinGlass figures cited in reporting. A rolling reading, not a completed daily total.
The takeaway: the funds spent most of 2026 shedding assets, bottoming at roughly $5.8 billion of net outflow on 13 July, and this week's $2.4 billion pushed the year to about $934 million positive. That is a statement about who is buying, not about what happens next. A flow figure describes a completed week.
2. This Week in Headlines
Market structure: an era ends quietly
BitMEX stopped trading at 04:00 UTC on Wednesday, 11 years after it introduced the perpetual swap. The closure was solvent and pre-announced on 23 July, withdrawals stayed open, and balances left behind accrue a fee of $50 a month or 1 percent a year. The instrument it invented now carries most crypto derivatives volume, which is the actual legacy.
Monday supplied the week's only real price event. More than $1 billion of positions were closed by force, about $878 million of them shorts, and CoinDesk reported shorts at 86.8 percent of the 24 hour liquidation total and about 95 percent of the previous hour's. Open interest rose 7.59 percent to roughly $156 billion.
Institutions: more plumbing, more venues
Circle opened Digital Asset-Backed Borrowing to eligible Circle Mint customers on Monday: deposit BTC, mint a wrapped token called cirBTC, post it as collateral on an approved lending market, receive USDC. CME Group said on Tuesday it will list Bitcoin Cash and Uniswap futures on 19 October, pending regulatory review. Strategy's 8-K reported 950 BTC bought at an average of $79,670, taking it to 846,000 BTC, and Strive reported 1,355 BTC near $79,475.
Regulators: collateral and supervision
CFTC staff guidance now sets out how registrants may hold crypto: a capital charge of at least 20 percent on a futures commission merchant's own bitcoin and ether, 2 percent on payment stablecoins, clearing houses permitted to take crypto as initial margin, and no customer money invested in stablecoins. The numbers deliberately match the SEC's broker-dealer treatment, which is how two agencies avoid arbitrage without legislation.
Outside the United States
The Eurosystem launched Pontes on Monday, linking market distributed ledger platforms to the ECB's settlement systems so tokenised securities settle against central bank money rather than a commercial bank deposit. Thirteen banks are onboarded, including Deutsche Bank, Santander and the European Investment Bank, with four ledger operators and full functionality due by 2028. Two days later the European Securities and Markets Authority made digital innovation a Union Strategic Supervisory Priority from 2027, focused first on artificial intelligence and tokenisation.
3. The Weekly Deep Dive: who actually holds the bitcoin in a spot bitcoin ETF
The question matters this week because the same seven days produced the year's largest exchange theft and the year's largest fund inflow, and a reader is entitled to ask whether the second is exposed to the first.
Start with what you own. Buying bitcoin on an exchange gets you a database entry: a claim on a company that has promised to hand over a coin when you ask. Buying a spot bitcoin ETF gets you a security, a share of a trust whose only meaningful asset is bitcoin. In both cases you are trusting somebody else to hold the keys. The difference is who, under what rules, and through what machinery.
In a spot fund, the coins sit with a qualified custodian appointed by the fund's sponsor, segregated from the sponsor's own balance sheet and held in cold storage. There is no automated withdrawal endpoint, because the fund has no retail customers asking to withdraw bitcoin. Shares are created and redeemed in large blocks by authorised participants, and that machinery deals in cash and shares, not in coins moving to strangers. Our note on ETF creation and redemption covers that part.
So the honest answer is that a hot wallet breach at a trading venue does not reach fund assets, and this week demonstrated it: $2.4 billion arrived through one route while the other route lost $351.6 million. That is not a claim that the fund route is safe. It moves the risk rather than removing it. A fund holder cannot withdraw the asset, pays a management fee every year, trades only in market hours, and depends on a custodian concentration that is far narrower than the exchange market. If a major custodian failed, several funds would discover they share a single point of failure. Self-custody avoids both, at the price of making every mistake yours.
What a reader can actually check: a fund's prospectus names its custodian and states whether assets are held in cold storage and how they are segregated, and most issuers publish holdings daily. An exchange publishes, at best, a proof of reserves snapshot that shows coverage at a moment in time and says nothing about liabilities you cannot see.
4. Security and Onchain Radar
Bitget's security systems detected unauthorised transfers out of its wallets at 18:31 UTC on Thursday 24 September. The exchange suspended withdrawals and put the confirmed figure at about $351.6 million, with reporting elsewhere placing roughly $387.5 million in total at attacker-controlled addresses. Chief executive Gracy Chen said user funds are safe and that the loss falls inside a User Protection Fund the company describes as holding over $464 million. Bitget has pointed to compromised third-party security software and engaged Mandiant and SlowMist. Some reporting notes infrastructure and tradecraft resembling past North Korean operations; treat that as an allegation until forensics are published.
Two things are confirmed: the money left, and no customer has been reported out of pocket. Two things are not: the entry route, and whether a protection fund of that size is genuinely segregated and liquid. A fund is a promise from a company, and the composition of this one is worth more scrutiny than it has had.
The rules: keep on an exchange only what you need there this week, and move the rest to cold storage. When an exchange halts withdrawals, act only through its own status page reached by typing the address, never through a message that found you. Expect fake support accounts offering manual processing; there is no manual queue.
5. From the Academy Library
Custody choices and the trade-offs above are covered in the cold storage guide, venue and counterparty risk in the beginner guide to crypto trading, and the policy backdrop in the crypto tax and regulatory guide. This year's incidents are tracked on the crypto exploit tracker, Monday's squeeze was explained in Tuesday's Daily Ledger, and new readers can start at Academy School.
Three useful, non-affiliate tools for the questions this issue raises: a fund issuer's own daily holdings page, the SEC's EDGAR full-text search for the filings quoted above, and an independent proof of reserves aggregator for exchange coverage ratios. All three show you a snapshot, which is the correct amount of confidence to take from any of them.
The week's two biggest stories pointed in opposite directions and neither moved the price, because the money deciding the price this autumn is not held where the news happened. That is a change in market structure, and it is the kind that only becomes obvious in a week like this one.
Disclaimer: This publication is for education and information only. It is not financial, investment, legal, tax, or security advice.
Sources and further reading
Market structure and exchanges
- CoinDesk: BitMEX shuts down trading after 11 years and leaves withdrawals open
- CoinDesk: short squeeze drives bitcoin toward $85,000
- CME Group: Bitcoin Cash and Uniswap futures from 19 October
Flows and institutions
- CoinReporter: spot bitcoin ETFs record 2026's strongest weekly inflows, flipping year to date flows positive
- Circle: Digital Asset-Backed Borrowing product terms
- SEC EDGAR: Strategy Inc Form 8-K, 21 September 2026
- SEC EDGAR: Strive Inc Form 8-K, 21 September 2026
Policy and international
- European Central Bank: Eurosystem brings central bank money to tokenised finance
- ESMA: new supervisory priority on digital innovation from 2027
- Lowenstein Sandler: Crypto Brief, 24 September 2026, on the CFTC collateral guidance
Security
- CoinDesk: Bitget loses $352 million in a hack and says user funds are safe
- Forbes: Bitget hack of $351.6 million triggers a withdrawal freeze