At half past two on Thursday afternoon, New York time, Bitget's monitoring flagged transfers leaving its hot and warm wallets that nobody had authorised. Somebody had, though. The exchange had. Withdrawals stopped across the entire platform, and when the accounting settled the number was $387.5 million.

Nobody stole a private key, and the cold wallets were never touched. Both of those are the exchange's own account of it, with Mandiant and SlowMist still working. Here is chief executive Gracy Chen describing what actually happened: the attacker "compromised a critical backend system within our wallet infrastructure, used it to spoof transaction data, and triggered our authorization process to move funds out."

Read that twice. The signing infrastructure worked exactly as designed. It was shown a lie, and it signed.

Which brings us to the part that should bother you, and it is not the money.

Bitget publishes proof of reserves. Here is what its own page says that proves: "that the total assets held by the platform are no less than the sum of all users' assets." A Merkle tree, SHA-256 over every account name and balance, adjacent hashes paired and computed layer by layer up to a root. It is real cryptography and it does exactly what it claims.

What it claims is that the coins are there. It says nothing about who can move them. Every one of those reports could have been accurate on the morning of the 24th, and none of it told a single customer anything about the risk they were actually carrying. Proof of reserves proves possession. What failed here was control.

Now the detail that makes this yours rather than somebody else's problem. The chains drained were Ethereum, the XRP Ledger, Arbitrum, Avalanche, Optimism, BNB Chain and Base, with Zcash and TRON added the next day, on Bitget's own accounting, when it revised the loss up from $351.6 million. Bitget has published no per-chain breakdown, and the tracers disagree about which chain lost the most. The largest single asset is not in dispute: about 102.93 million XRP, some $157 million at the prices when it moved.

Bitcoin is not on that list. Not one coin of it was touched.

Bitcoin withdrawals were frozen for about three and a half days anyway.

That is the self-custody argument made by events rather than by us. The coins that were safe got locked in the same room as the coins that were not, because the thing holding the door shut is not the chain. It is the company.

Two more things happened that are worth more than the headline number. GoPlus Security tracked about 101.5 bitcoin, some $8.5 million, already out through THORChain, and another 27.63 million XRP, about $43 million, moving through swaps toward bitcoin. Other tracers put part of the bitcoin leg through Chainflip as well. THORChain is permissionless by design, and the question of whether it should stop flows like these was put to its founder, John-Paul Thorbjornsen, in public and answered in February 2025, after the Bybit theft: he would support his own nodes running a static deny list built from OFAC or FBI data, and would not support a non-authority third party updating such a list dynamically at the protocol level. He has said nothing new about Bitget, and nobody should present a nineteen-month-old position as a fresh one. That is censorship resistance working exactly as advertised. This is what it costs, in daylight, with a number attached to it.

And then the freeze that was not one. Circle and Tether between them froze about $318,000, which is what the on-chain record shows rather than anything either issuer has announced. Against $387.5 million that is 0.0821%. Neither issuer was slow. Elliptic found the stolen funds were "converted rapidly out of stablecoins and other non-native tokens into each chain's native asset," a technique it calls consistent with North Korean laundering, and which would make this the largest single theft attributed to North Korea this year across more than 51 tracked incidents. Attribution is not closed and everybody involved says so. The mechanical part is not in doubt: the attacker's first move was out of the only assets on earth that anybody can freeze.

One more number, and this one is our arithmetic rather than theirs. Bitget's User Protection Fund holds 5,500 bitcoin, and the exchange's own wording is that much of the fund is in bitcoin rather than all of it, so this is the bitcoin leg and not the whole cushion. At this morning's price that is a little over $450 million against a $387.5 million hole, so it covers, with roughly $70 million to spare. It stops covering at a bitcoin price of $70,455, about 15% below where bitcoin is trading as we write. An insurance fund denominated in the asset whose fall would trigger the claim is a choice somebody made deliberately, and it is worth knowing that the cushion is a function of the price.

Bitget's published schedule reopens bitcoin withdrawals at 08:00 UTC this morning, four o'clock here, three and a half hours before this email. Ether follows tomorrow, tether on Wednesday, everything else on 2 October.

And the network is close to free. As we write, mempool.space has the half hour, hour and economy tiers all at one satoshi per byte, with the fastest tier flickering between one and two across the small hours and tens of thousands of transactions sitting in the queue. We flagged that floor on Wednesday and it has held through the weekend. If you have been postponing moving coins off an exchange because the fee felt like a reason not to, the cheapest hour in months is arriving in the same hours Bitget opens the door.

Three metrics.

Metric 1, Fear and Greed: 74, Greed. It has held a 70 to 74 band for six days after peaking at 78 on the 22nd. Now set that against the positioning. Deribit's perpetual funding is flat at zero, the eight-hour rate reading 0.000003%, which is zero to three decimal places. Nobody is paying to be long. Nobody is paying to be short. The survey says greed and the money says nothing at all, and when a sentiment gauge and a funding rate disagree it is usually the funding rate telling the truth.

Metric 2, ETF flows: plus $134.5 million on Friday, the seventh consecutive day of inflows and the smallest of the seven. The run across last week reads 999.0, 714.7, 346.9, 190.7, 134.5. Friday was 13% of Monday. "Seven-day streak" is the flattering way to describe that and "streak intact, decaying by an order of magnitude inside a week" is the accurate one. September stands at plus $2,699.2 million with three sessions to go, and we should be precise about where that comes from: Farside publishes no monthly subtotal anywhere on its site. That figure is our own sum of its printed daily totals, checked against its cumulative series.

Metric 3, BTC dominance: 58.69%, on a total crypto market a little over $2.8 trillion, which has fallen about 5% in a day. Strategy has filed no new bitcoin purchase as of press time. Its Monday 8-K normally lands about eight o'clock, half an hour after this email, and we are not going to guess at what is in it. What it did file on Friday is not a bitcoin document: the board is asking shareholders to move all four preferreds to daily dividends, a record date every calendar day. STRC goes first, record date 1 November and payment on 2 November, and the other three do not start until January. The filing states outright that this changes neither the rates nor the totals. It is a frequency change, and you will see it written up as a yield increase. In an investor presentation filed the same evening, Saylor states the objective plainly: "Our objective is for STRC to trade between $99 and $100, but generally we're targeting $100 par value." STRC closed Friday at $98.54, under his own band, and in the week to 20 September, the last one disclosed, the company spent $174.0 million buying it back at about $98.24. Meanwhile Sequans announced on Thursday that it has sold the last 314 coins it held at the end of June and now holds none, down from 2,139 at the end of last year, out of the 3,234 it ever bought. Two companies, three days apart, opposite directions.

The STACK grades a test this morning, which it has not done since Monday. Rule, number, verdict and consequence are down there, in that order.

📣 THIS SPOT IS OPEN

Baseline Crypto reaches nearly 7,000 Bitcoin-focused readers every Monday and Wednesday morning, opening about half of what we send. Direct sponsor placements are open, premium position, top of the issue, one per send.

Reply to this email for rates.

The same release says reserves rose $48.4 billion, and that is not a contradiction. It is two instruments pointed at two different questions, and the argument is about which question you were asking.

Take the strong version first, because the $83.6 billion is real and it is ours. Thursday's H.4.1 prints reserve balances for the week ending 23 September at $2,930.193 billion, against $3,013.794 billion the week before. That is a fall of $83.601 billion, it is the series our own dated test names, and anybody reading it as a drain is reading the number the Fed published, in the direction it went.

Now the other number, from the same table, on the same page. The H.4.1 also prints a Wednesday level, a snapshot of where reserves actually sat on the day rather than an average across the week. On 16 September that was $2,921.536 billion. On 23 September it was $2,969.922 billion. Up $48.386 billion.

And the reason is three lines higher on the same page. The Treasury's own Wednesday close went from $991.708 billion to $947.317 billion over those same seven days. Down $44.391 billion. Money left the government's account and turned up in bank reserves, close to dollar for dollar.

So one number says the banking system lost $83.6 billion and another says it gained $48.4 billion, in the same week, in the same release, and both are arithmetically correct.

The resolution is a calendar.

The week ending 16 September contains several days that fall before the 15 September corporate tax date, when the Treasury's account was sitting in the $818 to $871 billion band. The week ending 23 September is entirely after it, with the account in the $947 billion to $1,004 billion band. So the week-average comparison straddles the tax date and measures it. The Wednesday-to-Wednesday comparison starts after the tax date had already happened and measures what came next.

Which means they are not competing answers. A weekly average is the right tool for "did the tax date pull money out of the banking system," because it covers the days on both sides of the event. It is the wrong tool entirely for "is that money coming back," because it is still dragging the pre-tax days along as ballast. The Wednesday level answers that second question, and its answer is yes, it is coming back, and here is how much.

This is the same failure as the one at the top of this issue, wearing different clothes.

Bitget's proof of reserves was an accurate answer to "are the coins there." It was never an answer to "can somebody else move them," and nobody had asked it to be. A weekly average of reserve balances is an accurate answer to "what did the banking system hold across these seven days." It is not an answer to "how much liquidity is in the system this morning." In neither case is anyone lying, and in neither case is the number wrong. The number is simply not doing the job somebody handed it.

Our own stake in this, since we have one. We named WRESBAL, the weekly average, when we set the test on 21 September, and we are grading on WRESBAL, because that is the rule we published and the goalposts do not move after the ball has landed. On Wednesday we printed the gap between the average and the snapshot, called it an artefact of comparing two different kinds of measurement, and said it flips sign in roughly half the weeks we pulled. It flipped this week, in our favour on one reading and against us on the other. That does not make either series wrong. It makes the pairing meaningless unless you say which one you meant, which is the entire point.

One thing to carry into Wednesday. The week now running ends on 30 September, which is quarter end, month end and fiscal year end at once, and it is the classic date for banks to dress the balance sheet. The H.4.1 that covers it publishes on Thursday 1 October. Whatever it says, ask which of those two numbers it is before you decide what it means.

Three numbers that define the next week.

2.83%, the ten-year real yield, and the number next to it that did not move at all. On 21 September the ten-year real yield, on Treasury's own curve, was 2.62%. On Thursday it hit 2.85%, the highest since 2008. On Friday it eased to 2.83%. Twenty-one basis points in four sessions, and 51 basis points on the month from 2.32% on 25 August. Over that same stretch the ten-year breakeven, which is the bond market's own inflation forecast, went 2.34, 2.33, 2.35, 2.33 and 2.34 again on Friday. A two basis point range across the whole move. Nothing. In plain English: cash and Treasury bonds just got meaningfully better paid, and nobody raised their inflation forecast to justify it, so the reward for holding something that pays no yield went down. Gold did what the textbook says and fell 6.6% over the four weeks to Friday, on the LBMA afternoon fix. Bitcoin did not, and is up 8.0% over exactly the same four weeks, on Coinbase closes. That is a gap of just under fifteen points between the two assets that are supposed to trade on the same logic, and one of them is wrong about something. We do not know which, and telling you that is more useful than a tidy story about debasement. This also carries our 14 September dated test across a branch line, from Branch B into Branch A, which is 2.80% or above. It does not grade today. It grades on the print for 30 September.

Wednesday, when the fiscal year, the quarter and the month all end on the same day. Put it in the diary, because five separate things we track resolve or reset on it. Quarter end is the classic moment for overnight funding to spike, and SOFR has already firmed three basis points to 3.88% inside a 3.75 to 4.00 target range. The August PCE report lands at 8:30 that morning with the third estimate of Q2 GDP beside it. The EIA resumes its Brent series and fills in the three sessions it currently owes. ICE Brent's November contract has its last trading day. And the Treasury cash balance that grades our 2 September test is set at that close. One thing that is not happening on Wednesday, because it is being repeated in a lot of places and it is simply false: there is no government funding deadline. The continuing resolution signed on 2 September runs to 11 December, and the statute says so in terms.

118,263 bitcoin, which is the option expiry that actually matters, and it is not this week's. Deribit's 30 October expiry carries 118,263 coins of open interest, a little under $10 billion at this morning's index, and it is lopsided in a way nothing else of size on the board is: 90,502 coins of calls against 27,761 of puts, a put-to-call ratio of 0.31, or 3.26 calls for every put. It expires two days after the October FOMC. For comparison, the 25 December expiry is almost identical in size at 119,042 coins and nothing like as one-sided, at 0.60. And while we are here: the 30 September expiry is a daily, 2,225 coins, about $185 million, a non-event. There is no quarter-end quarterly. September's quarterly expired on the 25th and is already off the board, and anywhere you read otherwise this week, that is the error.

Forget analyst predictions. Polymarket is a real-money prediction market, where traders put actual dollars on outcomes. Scorecard first, then the board. Not financial advice. Our read. Disclosure: we hold personal positions in Polymarket itself and may earn a commission from Polymarket referrals. These markets are thin and the odds below move, so read direction over ticks.

Scorecard. The reserve balances test resolves today. Rule, number, verdict, consequence, in that order.

The rule, as published on 21 September: Federal Reserve reserve balances, FRED series WRESBAL, for the week ending 23 September 2026. Branch A below $2,900 billion. Branch B $2,900 billion up to but not including $3,000 billion. Branch C $3,000 billion or above.

The number: $2,930.193 billion. FRED's WRESBAL, updated Thursday afternoon, and the H.4.1 release of 24 September, agreeing to the dollar.

The verdict: Branch B.

The consequence, and it has two halves. The first is that we never called a branch in print. We set the test on 21 September and declined to say where it would land, and on Wednesday we printed the arithmetic without pre-grading it. So this is a clean resolution and not a win, and we are not going to dress it up as one. The second half is worth more. When we wrote this test the last published figure was $3,013.794 billion, which is Branch C. Reserves fell $83.601 billion in a single week and dropped clean out of the branch they were sitting in when the question was asked. That is the part that was not obvious on the 21st, and it is why the test was worth setting.

The other four, with live levels.

US spot bitcoin ETFs net positive for September, grading 7 October. Tracking Branch A at about plus $2,699.2 million through Friday. Three sessions remain, and flipping the month negative would take an average of worse than minus $899.7 million a day against a worst single day on record of minus $1,113.7 million. Arithmetically possible, historically unprecedented, and not closed until it closes. One correction to how this gets graded, stated in print so it cannot be fudged later: Farside publishes no monthly subtotal anywhere on its site. The figure above is our own sum of its printed daily totals, checked against its cumulative series, and that is the measure this test should be read against.

The Treasury cash close on 30 September, grading 5 October. Branch C is below $950 billion. Live: $924.627 billion on Thursday, which is Branch C. Worth saying out loud, because it is not the branch we would have guessed when we wrote this on 2 September: Branch C was defined as Treasury undershooting the assumption it published itself, and it is currently undershooting it by $25.4 billion with three business days to run.

High yield spreads on 30 September, grading 7 October. Branch B is 2.70% to under 3.00%. Live: 2.80% on Thursday, having widened 14 basis points in three sessions from 2.66% on Monday. Two consequences, both ours. Our separate 2 September commitment says that spreads at or inside 2.70% at the late-October cash peak means our framing of this cycle was wrong. At 2.80% that line is 10 basis points away and moving our way for the first time in a while. And the published entry condition, spreads widening through 3.00%, is 20 basis points away, which is the closest it has been since we wrote it.

The ten-year real yield on 30 September, grading 7 October. Branch A is 2.80% or above. Live: 2.83% on Friday, after touching 2.85% on Thursday, which is the highest since 2008. It crossed from Branch B into Branch A inside this window, and the reasoning is in BEYOND THE CHARTS above. It grades on the print for 30 September, not on Friday's.

The book. Flat for the sixteenth consecutive issue, recomputed from the archive tonight rather than carried forward. The ledger still reads fifteenth, which was correct on 23 September and is not correct this morning. The rule governing all of this is unchanged: a call counts as a win or a loss only when a published issue printed its exit, or the market resolved while we held it and an issue said so. Nothing else counts, in either direction, and that cuts against us more often than for us. Sixteen issues is a long time to stand aside, and we said on Wednesday that we would stop announcing the number as though it were a virtue. So here is the substance instead. Two published rules are live. High yield spreads through 3.00%, now 20 basis points away and closer than at any point since we wrote it. And the October leg below 40%, which this week went ten points the other way.

Fed decision in October, 25 bps increase | Market: 64.5% 🟡 NO TRADE, and our own rule is further away than it has ever been
No change is 33.5%, and everything else on that board, both cuts plus a 50 basis point increase, adds to under 1.6% combined on $15.1 million of volume. The path is the story rather than the level. We printed 54.5% a week ago. Inside a quarter of an hour of that email sending the contract traded down to 49.5%, and it made its low of 48.5% later that morning, which is the figure we printed on Wednesday. It is 64.5% now, ten points above our print and sixteen off the low. We had no position through any of it, which means we did not lose anything and we did not earn anything either. What would put us in: this leg below 40%. Two voters in prepared texts this week make that considerably less likely than it looked seven days ago, and the honest read is that this entry may never trigger before the meeting.

Fed decision in December, 25 bps increase | Market: 67.5% 🟡 NO TRADE, and the interesting part is that it is priced ABOVE October
December prices a hike at 67.5% against October's 64.5%. Read that carefully, because it is not the market saying December is likelier than October in isolation. It is the market saying the hiking does not stop at one, and that if October holds, December collects. No change in December is 29.5%. The caveat is size and it is a big one: this event carries $1.4 million of volume against October's $15.1 million, under a tenth, so treat every tick here as noise around a direction. What would move it: the October decision itself, on 28 October, which resolves this in an afternoon. We are not paying 67.5 cents to wait five weeks for something we can watch for free.

Zero Fed rate cuts in 2026 | Market: 97.25% ⚫ EXITED at 88.75%, a loss, and it is still widening
We were short from 78%, trimmed at 85% and covered the rest at 88.75% on a published stop on 3 August. For the first fortnight after that the market went our way, bottoming at 85.15% on 17 August, and the 10 August issue printed it at 85.75%. Since mid-August it has gone one way. We printed 96.45% on Wednesday. It is 97.25% now, another 0.8 points against us. That is the ordinary fate of a stop taken on a short that was wrong to begin with, and the reason we print it every time is that a scorecard which quietly drops its losers is not a scorecard. Event volume is $53.5 million, the deepest market on this board by a distance. What would move it back: not a soft data print and not a speech. One dot below the current midpoint in the December projections, from anybody on the committee.

Clarity Act signed into law in 2026 | Market: 5.7% ⚪ NO TRADE, and most of the board around it is not information
H.R. 3633 has no action dated later than 15 September, the Tillis motion to reconsider is entered and unexecuted, and we retired our re-entry rule in print on 16 September. Nothing this week revives it. What is worth your attention is how the surrounding markets behave when nobody is trading them. A second market asking effectively the same question prices it at 8.0% rather than 5.7%, on $26,000 of volume against this one's $23.1 million. And on the market counting Senate votes, "more than 62 senators" trades at 8.15% while "more than 50 senators" trades at 7.5%. Every world with 63 yes votes is a world with 51, so that ordering is logically impossible and it survives only because almost none of those legs has traded in a day. What would make any of this tradeable: a markup of the substitute text, which is the leg our retired rule turned on and which has never been scheduled. The bill itself has been through a committee, as we said in print a week ago, and almost everyone covering it still gets that loose.

Track everything live at polymarket.com, free, no account required.

On Wednesday we asked for one number: what a gallon of regular costs at the station nearest you. We rebuilt the question specifically so it needed no homework, no forecast and no defending a position to a stranger at half past seven in the morning. One number, reply, done.

Nothing came back. We went through the inbox and our own file of reader replies before writing this, and there is still nothing new since 3 August. That is four issues running.

We are not going to redesign the question a second time. Wednesday's diagnosis was right and the change made no difference, which tells us the format was not the problem, and announcing another mechanism would just be a third thing that does not work. So the question stays a question, we keep asking one, and when the answer is silence we say so rather than manufacture a split out of nothing. That is the deal, and it is the same deal that makes the scorecard above worth reading.

One question, and it is what this entire issue is about: do you have bitcoin sitting on an exchange this morning, yes or no?

Hit reply. We read every response, and the best calls run Wednesday.

See you Wednesday with the August PCE report, the EIA's first official Brent prints since the 22nd, and the Treasury cash close that decides whether it hit its own $950 billion.

The Baseline Crypto Team

Two tools. Free, no account, nothing to install, and both checked again before this went out.

The hardware wallet checker takes your device and firmware version and tells you whether you are inside a population with a known problem, and what to do about it if you are. The custody audit is nine questions about what happens to your coins when something goes wrong, and most people fail it on backups and inheritance long before the hardware is ever the issue.

One genuine new exposure out of this window, because it is exactly the sort of thing that never makes a headline. Bitcoin Optech's newsletter on Friday covered BIP138, a proposal for compact encryption of non-seed wallet data, and flagged that because it derives its encryption from root public keys, a single-signature wallet that shares its account xpub with a server would let that server decrypt the multisig backups that reuse that same xpub. Keeping single-signature and multisig on separate account keys, which is what BIP48 and BIP87 are for, closes it. If you run multisig and also use a single-sig wallet that talks to a vendor's server, that is a real path and it is worth checking.

And the closing instruction, which we gave you four days ago about a different exchange. On Wednesday we pointed at the person who still keeps coins somewhere custodial because moving them is a hassle, and the reason then was BitMEX charging 1% a year on balances nobody had withdrawn. Here is the same person again with a better reason. Bitget's bitcoin was never touched, was never at risk, and its customers still could not withdraw it for about three and a half days. Fee tiers are at or within a satoshi of the floor this morning and the withdrawal queue was due to open at four.

Different ask than Wednesday's, though. Do not forward anything. Open the custody audit yourself, answer the nine questions about your own setup, and then work out how many of them you could answer on behalf of the person you were about to send it to. If the honest answer is none, that is the conversation, and it is a much better one than a link.