Crypto News Today: NEAR Intents Blocks $50 Million of Bitget Hack Transfers as THORChain Declines to Freeze Funds

Last Updated: September 29, 2026

Five days after the $387.5 million Bitget breach, the fight over where the stolen money goes has moved to cross-chain swap services. NEAR Intents said its SHIELD system blocked more than $50 million of attempted transfers tied to the hack, while THORChain refused a request from Bitget to block the attacker’s addresses. Elsewhere, SEC staff clarified when token buybacks create an investment contract, Goldman Sachs opened its $100 billion Treasury fund to crypto firms, and Bitcoin traded near $83,819, according to CoinMarketCap.

Key Takeaways

NEAR Intents blocked more than $50 million of attempted transfers linked to the Bitget hack, froze about $503,000 and waived Bitget’s 5% bounty. THORChain, which says it does not censor by design, processed 27 swaps that turned about 2,390 ETH into 75.2 BTC, roughly $6.3 million.

SEC staff said in FAQs released September 25 that announcing a buyback for an already functioning crypto network does not by itself create an investment contract. The guidance is staff-level and carries no force of law.

Goldman Sachs is offering its roughly $100 billion FTIXX Treasury fund to institutional crypto firms through the Lynq settlement network, without tokenizing the fund.

A joint statement from US, Japanese, German and Australian cybersecurity officials says North Korea-linked WaterPlum infected at least 30,000 devices and stole about $10.71 million through fake job interviews.

Chainlink launched CCIP 2.0 on September 28 and connected banks to the Swift ledger, and Australia’s crypto licensing deadline arrives on September 30.

Today’s Top Stories

NEAR Intents blocks Bitget hack transfers while THORChain holds its line. NEAR Intents general manager Alex Shevchenko said the platform’s SHIELD system detected and blocked more than $50 million of attempted transfers tied to the September 24 Bitget breach, froze about $503,000 mid-execution and waived the 5% bounty Bitget offered, so more money can return to the exchange through legal processes. About $166,000 of suspected stolen funds slipped through, and the rejected transfers moved on to other providers. THORChain took the opposite position. After Bitget CEO Gracy Chen asked it to refuse the attacker’s addresses, THORChain said its emergency halt mechanisms protect the protocol rather than freeze individual swaps, and on-chain tracking showed 27 swaps that converted about 2,390 ETH into 75.2 BTC. Circle and Tether froze about $318,000 in USDT and USDC linked to the exploiter on Friday. Bitget puts its total loss at $387.5 million, says its protection fund holds more than $464 million, and restored Bitcoin withdrawals on Monday, with Ether scheduled for September 29. Our earlier report on the breach covers the initial disclosure.

SEC staff say buybacks and network upgrades do not automatically create an investment contract. In FAQs released September 25, the SEC’s Division of Corporation Finance said that announcing a buyback for an already functioning crypto network does not by itself make the token subject to an investment contract, and that work to secure, maintain or improve a live network is not the kind of managerial effort that keeps a token tied to one. The answer can differ for a network that is not yet functioning if the buyback is pitched as a source of returns. Reports on September 29 said staff also revised the buyback answer after a16z crypto general counsel Miles Jennings raised concerns, stating that a buyback with no centralized entity behind it typically does not form an investment contract. The CLARITY Act failed a Senate procedural vote in mid-September, and Commissioner Hester Peirce, who led the SEC’s Crypto Task Force, leaves the agency on October 2, which will leave two commissioners in place.

Goldman Sachs opens its $100 billion Treasury fund to crypto firms. Goldman’s FTIXX fund is now available to institutional crypto firms through Lynq, a settlement network built on a permissioned Avalanche blockchain, and it is the first outside fund offered there. Unlike BlackRock’s BUIDL and Franklin Templeton’s BENJI, FTIXX is not tokenized. Lynq acts as a distribution channel, with trades handled by SEC-registered broker-dealer tZERO Securities. Lynq participants include B2C2, Wintermute, Galaxy, FalconX and Fireblocks, which can park idle cash in the fund between trades and earn yield. The rollout is limited to US-based customers, and Lynq supports more than 30 institutional clients holding over $89 million in custodied assets, so the channel starts small next to the size of the fund.

North Korea-linked WaterPlum steals $10.71 million through fake job interviews. A joint statement from cybersecurity officials in the United States, Japan, Germany and Australia says the group infiltrated at least 30,000 devices and took about $10.71 million in cryptocurrency from roughly 7,000 accounts across hundreds of countries, ABC News reported. The group ran job ads to collect sensitive information from applicants, used AI face-swapping software when online interviews began and then asked to switch off cameras, citing network problems. It targeted individual IT professionals. Japanese authorities uncovered the scheme after identifying a laptop farm that hid the group’s location and finding crypto transfers leaving the country.

Chainlink launches CCIP 2.0 and connects banks to the Swift ledger. The upgrade, released September 28 at Swift’s Sibos conference, lets asset issuers run their own Cross-Chain Verifiers on top of Chainlink’s default 16-operator network and adds an Automated Compliance Engine with allowlists, sanctions checks and transaction limits. Launch partners include Amazon Web Services, Google Cloud, ANZ Bank, Fidelity International, Infosys and SBI Digital Markets, and Chainlink says its infrastructure secures more than $84 billion in cross-chain token value. The release comes five months after the $292 million Kelp DAO hack, which was blamed on a bridge setup that relied on a single verifier. LINK rose 10.62% over 24 hours, as covered in crypto market today.

Australia’s crypto licensing deadline arrives on September 30. ASIC has told digital-asset businesses relying on its temporary no-action relief to apply for or vary an Australian Financial Services licence by September 30. From October 1, firms that need a licence but have not applied risk civil and criminal penalties, including fines of up to 10% of annual turnover. The regulator has recorded more than 45 digital-asset licence applications since it updated its guidance in October 2025, and a new statutory framework, the Digital Assets Framework Act, takes effect on April 9, 2027.

What This Means for the Days Ahead

Several dates cluster around the end of the month. Bitget’s Ether withdrawals are scheduled to reopen today, with the remaining assets following in stages through October 2. ASIC’s licensing deadline and the August PCE inflation report both land on September 30. Peirce’s last day at the SEC is October 2, and the SEC’s decision on Nasdaq ISE’s crypto ETF-options listing standards has moved from September 27 to November 11.

In the Bitget case, the tracing dashboard the exchange published lists attacker addresses across Ethereum-compatible networks, the XRP Ledger, Zcash and TRON, so later movements can be followed on-chain. The split between NEAR Intents and THORChain shows how differently cross-chain services handle requests to block stolen funds.

For asset-specific coverage, visit Bitcoin News Today, Ethereum News Today, XRP News Today, Zcash News Today, and Hedera (HBAR) News Today.

Compare Crypto Prices Today

Asset	Price Page
Bitcoin	Bitcoin Price
Ethereum	Ethereum Price
XRP	XRP Price
Solana	Solana Price
BNB	BNB Price
TRON	TRON Price

Where to Buy Crypto

Cryptocurrencies can be bought on major exchanges including Binance, Coinbase, Kraken, KuCoin, Gate.io, OKX, and Bybit.

This article is for informational purposes only and does not constitute financial advice. Cryptocurrency markets are volatile; always do your own research before investing.

Frequently Asked Questions

What is the biggest crypto news today?

The biggest story is the fight over the Bitget hack proceeds. NEAR Intents said it blocked more than $50 million of attempted transfers tied to the $387.5 million theft, while THORChain declined to freeze attacker addresses and processed swaps worth about $6.3 million. Other headlines include the SEC’s token buyback guidance, Goldman Sachs opening its $100 billion Treasury fund to crypto firms and Chainlink’s CCIP 2.0 launch.

Why did THORChain refuse to freeze Bitget hacker funds?

THORChain says it does not censor by design, and that its emergency halt mechanisms protect the protocol rather than freeze individual swaps. Bitget CEO Gracy Chen had asked it to refuse addresses tied to the attack. On-chain data showed 27 swaps turning about 2,390 ETH into 75.2 BTC. NEAR Intents took the opposite approach and said it blocked more than $50 million of attempted transfers.

What did the SEC say about token buybacks?

In staff FAQs released September 25, the SEC’s Division of Corporation Finance said that announcing a buyback for an already functioning crypto network does not by itself make the token an investment contract. The answer may differ if the network is not yet working and the buyback is pitched as a source of returns. The FAQs are staff guidance and carry no force of law.

What is the WaterPlum crypto attack?

WaterPlum is a North Korea-linked hacking group that used fake job ads and AI face-swapping in online interviews to infect at least 30,000 devices, according to a joint statement from cybersecurity officials in the United States, Japan, Germany and Australia. It stole about $10.71 million in cryptocurrency from roughly 7,000 accounts and mainly targeted individual IT professionals.