Bitcoin hit an eight-month high this week. Solana crossed $120 for the first time since January. Bitcoin ETFs erased a $5.8 billion deficit and turned positive for the year.
And the largest crypto hack of 2026 happened on Thursday — now put at $387.5 million gone from Bitget — and almost nobody noticed.
This is your weekly crypto brief for the week ending Sunday, September 27, 2026. The rally broadened out beyond Bitcoin, real buyers showed up underneath the short squeeze, and the market shrugged off a nine-figure theft. There are good reasons for all three, and one significant thing working against them.
What actually moved
This weekly crypto brief has spent most of September tracking a market driven entirely by macro events. This week the crypto-specific stories finally mattered again.
Bitcoin (BTC): Broke above $85,000 on Monday — its highest since January — as roughly $648 million in short positions were liquidated in 24 hours. Ran to an intraday peak of $87,265 on Wednesday, an eight-month high. Pulled back Thursday on hot economic data, closing at $84,379. Ended the week around $84,000, up roughly 10% over seven days.
Ethereum (ETH): Peaked at $2,787.96 on Wednesday. Settled around $2,692 by Friday evening, up 0.9% on the day and roughly 10% on the week.
Solana (SOL): The week’s standout, and it gets its own section below. Broke $120 on Friday and kept going — touching as high as $124.92 over the weekend before settling into the low $120s.
XRP: $1.57, up 2.1% on Friday.
One thing that shaped Friday: a $15.6 billion options expiry hit the market. Bitcoin’s rally stalled into it while XRP and Solana kept climbing — a reminder that a big expiry can pin the largest asset while the rest of the market carries on.
Market-wide: Total crypto market cap sat at $2.98 trillion early Saturday, with 24-hour volume of $109.2 billion. Bitcoin dominance at 56.5%, Ethereum at 11%. The Fear and Greed Index reached 74 — firmly in greed territory, up from 71 the previous week.
The rally broadened out
Something changed this week that hadn’t been true for most of September.
The altcoin season index hit its highest level in more than three months. On Thursday, 93 of the 100 constituents in the CoinDesk 100 rose. Quant jumped 39% in 24 hours. Solana cleared a level it hadn’t seen since January.
A rally where only Bitcoin moves is a different animal from one where the rest of the market participates. For most of this year, crypto has been Bitcoin plus a long tail of assets that followed it down and lagged it up. This week the tail led.
Three things sat underneath the move, and only one of them was mechanical:
The short squeeze continued. Roughly $648 million in short positions cleared on Monday as Bitcoin broke $85,000. That’s the same mechanism that drove last week’s move, just larger. If you want the machinery behind it, our piece on why crypto prices move together covers how liquidation cascades work in both directions.
Corporate treasuries bought. Strategy purchased 950 BTC for roughly $76 million on Monday, taking its holdings to 846,000 BTC. Strive acquired 1,355 BTC for about $107.7 million, bringing its total to 26,355. That’s roughly $184 million of direct demand between them — not forced buying, not derivatives, actual purchases.
And the ETF story turned. Which deserves its own section.
Bitcoin ETFs turned positive for 2026
This is the most significant number of the week, and it’s a milestone rather than a headline.
At one point in July, US spot Bitcoin ETFs were down $5.8 billion in net outflows for 2026. As of this week, that deficit has been erased entirely — the funds now sit at roughly $800 million in net inflows for the year.
The turnaround came fast. After bleeding $450 million on September 15 and $295.9 million on September 16 — the CLARITY vote and Fed decision days — flows reversed hard: $159.5 million in on September 17, then $433 million on September 18, with Fidelity’s FBTC leading at $310.7 million and BlackRock’s IBIT taking $108.4 million.
The honest framing: erasing a deficit is not the same as building a surplus. Eight hundred million dollars of net inflows across nine months, against a fund complex holding close to $100 billion, is a rounding error. What it signals is that the persistent institutional selling that defined the first half of 2026 has stopped.
That matters more than the number. A market where the largest holders are no longer net sellers behaves differently from one where they are.
Solana broke $120 — first time since January
Solana surged to $120.86 on Friday, clearing $120 for the first time since January 29. It kept climbing over the weekend, touching $124.92 at the high, and was trading in the low $120s by Saturday evening — up roughly 8.6% across the week.
The bigger number: SOL is now up more than 100% from its 2026 low of about $60.39 in June.
The recovery came in stages rather than one jump. August delivered a 41.5% gain. September moved from roughly $97 mid-month, to above $112 on the 18th, to a test of $120 earlier this week, to the break on Friday. That gradual structure is generally a better sign than a single violent move — it suggests accumulation rather than a squeeze.
What’s underneath it:
Solana ETFs are taking real money. US spot Solana funds recorded $32.81 million in net inflows on September 24 alone, with Bitwise’s BSOL staking ETF accounting for $27.97 million and Fidelity’s FSOL for $4.84 million. Combined assets across the funds have reached roughly $1.81 billion, with cumulative net inflows of $1.52 billion.
Derivatives activity is building. Futures open interest climbed to about $7.49 billion, up roughly 14% from $6.57 billion in early September. Futures volume ran $11.76 billion over 24 hours against $9.38 billion earlier in the month.
The network keeps shipping. Solana real-world assets surpassed $4.5 billion, and Alpenglow reached its second public test network this week — the consensus redesign targeting roughly 150-millisecond finality, now running on both public testnets so application teams can check their software before the live chain switches over.
One honest caveat. Rising open interest means more leverage in the system, not just more conviction. It’s the same fuel that made this week’s squeeze possible, and it works identically on the way down. Solana’s RSI sits around 61 — bullish but not stretched — where Bitcoin’s is closer to 71. Worth watching which of those resolves first.
Iran diplomacy resumed — and oil fell
The macro backdrop that has dominated this brief since February finally moved.
US and Iranian diplomats met directly at the UN General Assembly in New York — the first direct contact since June. Negotiations reportedly entered an “exploratory phase” after three months of exchanging messages through Pakistani mediators.
Iran proposed a seven-day plan to end the war, according to media reports, which would include reopening the Strait of Hormuz and resuming talks on its nuclear programme, conditional on the US lifting sanctions on Iranian oil trade.
Oil responded. Brent for November delivery fell to around $104.94 on Friday morning, with WTI down to $92.72 — and November crude closed the week near $92.41, down 2.3% on the day. That’s well off the $108 highs of two weeks ago.
Saudi Aramco restarted its East-West pipeline at reduced flow rates after a two-week shutdown, though loading at the Red Sea port of Yanbu remained idle.
Elsewhere, the Nasdaq Composite and Nasdaq 100 both closed at record highs as diplomacy hopes lifted broad sentiment. The White House separately denied rumours it was considering a temporary diesel export ban, after comments from the President on Wednesday had briefly pushed oil to a one-week high.
The war began on February 28. This is seven months in, and it’s the first genuine diplomatic movement in months. Whether it holds is a different question — this conflict has produced false dawns before.
The counterweight: rates are still going the wrong way
Here’s the thing that complicates the entire bullish read.
Thursday’s preliminary US purchasing managers’ index came in at 58.4 — the fastest business expansion since 2021. Strong economic data, which in the current environment is bad news for anything that doesn’t pay interest.
The consequences were immediate:
- Odds of a 25 basis point October rate hike rose to 69.7%
- US Treasury yields hit a 19-year high
- Bitcoin slid below $84,000 on the print before finding buyers near $83,600
So the full picture is this: crypto gained roughly 10% on the week while the probability of another rate increase climbed toward 70% and government bonds became the most attractive they’ve been since 2007.
Either the market has decided rates no longer matter for crypto, or it hasn’t finished pricing them. We don’t know which, and anyone who tells you they do is guessing.
Technically, Bitcoin is stretched. Daily RSI around 71, hourly above 80 at the peak. That’s strong momentum with elevated pullback risk — which is roughly what Thursday delivered.
Not everyone is cautious. Fundstrat’s Sean Farrell called the breakout “credible,” adding that he thinks “the crypto winter is over, although that does not necessarily mean the path higher will be linear.” Compass Point’s Ed Engel wrote that crypto is “in the early innings of a new bull market” with “few signs of overheating.”
Those are reasonable, hedged views. We’d note only that the same week produced a Fear and Greed reading of 74 and a hedge fund manager publicly targeting $250,000 for Bitcoin. Sentiment readings that high are not usually found at the beginning of anything.
Bitget lost $387.5 million — the largest hack of 2026
At 18:31 UTC on Thursday, September 24, Bitget’s security systems detected unauthorised transfers from a limited number of hot and warm wallets. The initial estimate was $351.6 million across Ethereum, the XRP Ledger, Arbitrum, Avalanche, BNB Chain and Optimism.
On Friday, Bitget revised the figure up to roughly $387.5 million. The exchange said the increase reflects a more complete accounting of transfers during the incident — additional assets traced on Zcash and TRON, plus XAUt, that weren’t captured in the first 24 hours. Crucially, it said the revision does not represent a second wave: “The incident remains contained and no further unauthorized transfers are possible.”
That distinction matters. An upward revision because tracing finished is a very different thing from an upward revision because the attack continued.
It is the largest confirmed crypto theft of 2026, ahead of Liquid Network’s roughly $319 million in early September and the April attacks on KelpDAO and Drift Protocol. Before this incident, TRM Labs had recorded $1.73 billion stolen across 333 crypto-related attacks in 2026.
The mechanism is the part worth understanding. Bitget says attackers compromised a core wallet-backend system, manipulated the transaction data that system displayed to its authorisation process, and caused Bitget’s own signing process to approve the transfers.
A direct private key leak has been ruled out. The keys were never stolen. The system that decided what those keys should sign was fed false information.
The response: withdrawals were paused while deposits and trading continued. Cold wallets were unaffected — Bitget operates a three-tier hot, warm and cold architecture, and the breach stayed in the first two layers. The exchange said its $464 million User Protection Fund covers the loss, which it still does even at the revised figure, though with a thinner margin.
Bitget says it has now identified the attack path and the method used to bypass its controls, and that the underlying vulnerability has been remediated. Independent teams from Mandiant and SlowMist are participating in the investigation — bringing in outside forensics is the right call and worth crediting.
The exchange has also launched a recovery bounty, paying 5% of any assets successfully frozen or clawed back. Some blockchain foundations have already frozen addresses linked to the theft, which could bring the final loss below $387.5 million.
North Korea is suspected. CEO Gracy Chen said North Korean involvement is “very likely,” citing IP addresses that Bitget’s preliminary investigation linked to VPN services associated with a North Korean hacking group. If confirmed, 2026 becomes the second-largest year on record for North Korean crypto theft in TRM Labs’ data — more than $1 billion, behind only 2025. North Korea–attributed hacks already account for roughly $690 million this year.
Where the money went: attackers swapped about $183 million of the proceeds into Ether. Their rushed buying on Arbitrum briefly pushed a WETH/USDC pool price to around $2,870 — a local distortion, not real demand. Circle and Tether froze one wallet holding roughly $318,000 in stablecoins early Friday. Other addresses still hold more than 63,000 ETH, which no issuer can freeze.
The scale in context: the drain represents roughly 83% of Bitget’s entire User Protection Fund at the revised figure. And September is now comfortably the costliest month for crypto theft in 2026 — DeFiLlama had logged about $342 million across the month’s earlier incidents; adding Bitget takes the total past $720 million.
The market barely moved. Bitcoin fell about 0.29% in the 24 hours after disclosure. Ether fell 0.2%. Both inside normal daily ranges. Bitget’s own token, BGB, dropped 3–5%. Traders read it as a Bitget problem rather than a sector problem — and on the evidence, they were right.
Two people in the industry put it well. Aneirin Flynn, CEO of security firm FailSafe, said the significance “is that it destroys the illusion that major exchanges have solved hot-wallet security.” Esme Pau of CertiK called it “one of the most substantive centralized exchange exploits of 2026” and noted that a drain of roughly three quarters of the protection fund — a figure that has since grown — “transcends a security lapse and makes it a crisis event.”
Four weeks, four security failures, zero broken blockchains
It’s now worth stating this as a conclusion rather than an observation.
- Liquid Network — a logic flaw in the software deciding which withdrawals were valid. Keys intact.
- Brevo — an email vendor compromised through its single sign-on handling, used to send phishing to hundreds of thousands of hardware wallet owners.
- Revolut — a company socially engineered into handing customer passports and home addresses to criminals who simply asked.
- Bitget — a backend system compromised, its authorisation process tricked into signing transfers.
Not one of these was a cryptography failure. Not one involved a stolen private key. Every single one was a failure in the systems, vendors or people surrounding the blockchain.
The industry data agrees. TRM Labs found that in the first half of 2026, infrastructure compromises accounted for roughly 15% of incidents but about 76% of losses. Compromised keys and credentials overtook smart contract bugs as the leading attack vector for the first time on record.
If you hold crypto on an exchange, the relevant question isn’t whether the blockchain is secure. It is. The question is whether the company’s internal systems, its vendors, and its staff are — and you have almost no way to assess that from the outside.
Our guides on how to buy crypto safely and how crypto wallets work cover the practical version of that problem.
Also this week: KelpDAO filed suit against LayerZero and co-founder Brian Pellegrino over the $292 million exploit in April, alleging they failed to disclose weaknesses in the protocol. It’s one of the first attempts to litigate responsibility for a major DeFi exploit, and worth watching regardless of the outcome.
The agencies keep moving
The Federal Reserve proposed stablecoin rules on Wednesday under the GENIUS Act, requiring backing by safe and liquid assets, redemption at par, and new reserve disclosures.
That’s the third major regulatory action in eight days, following the CFTC’s rulemaking filing and the SEC’s Innovation Exception. With the CLARITY Act dead, US crypto policy is now being written by agencies — and they are writing quickly.
Briefly, elsewhere:
- The SEC opened its tokenised securities pilot framework
- NYSE and Blockchain.com are exploring a partnership for 24/7 tokenised trading of US stocks and ETFs, pending regulatory approval
- Coinbase launched fixed-rate Bitcoin-backed loans on the Morpho protocol
- Canada’s Big Six banks are exploring tokenised deposits
- El Salvador’s crypto remittances grew 39.1% to $35.4 million in the first half of 2026 — still just 0.7% of total remittance flows, which is the honest way to read it
What to watch
This weekly crypto brief will be following all of these. Early October: the CFTC’s crypto rulemaking returns from White House review. Prerule filings typically get around ten working days, and it was submitted on September 17.
October 20: the SEC’s Regulation Crypto Assets comment period closes. This is where US crypto rules are actually being written now.
The October FOMC: odds of another 25 basis point hike sit near 70% after Thursday’s PMI print.
Bitget’s withdrawal restart. The exchange has set out a timetable and says the vulnerability is fixed. Whether withdrawals reopen fully and on schedule is the real test of its assurances — and whether the bounty programme recovers anything meaningful.
The Iran talks. A genuine deal reopening the Strait of Hormuz would be the single biggest macro event of the quarter for inflation, oil and rates.
The bigger picture
Two weeks ago crypto rallied because bad news was priced in and traders were positioned wrong. Last week we said the move was mechanical rather than fundamental.
This week has something more underneath it. Corporate treasuries bought roughly $184 million of Bitcoin. ETF flows erased a $5.8 billion annual deficit. Solana broke a level it hadn’t touched since January with real fund inflows behind it. The rally spread to 93 of the top 100 assets.
That’s a better quality of move than a squeeze.
But the same week delivered a 19-year high in Treasury yields, a 70% chance of another rate hike, a Fear and Greed reading of 74, and the largest exchange hack of the year — which the market ignored entirely. Ignoring a $351 million theft is not obviously a sign of a healthy market. It can equally be a sign of one that has stopped pricing risk.
Both things are true. The buying is real, and the complacency is real.
Next Sunday’s weekly crypto brief will cover the CFTC filing’s return from review, Bitget’s incident report, and whether the broadening rally holds through the end of the quarter.
Where to go next:
- New here? Start with our beginner path or dollar-cost averaging crypto — the strategy built for weeks when sentiment readings hit 74.
- This week involved short squeezes, rising open interest and a hot-wallet drain. Our newest guide, what is liquidity in crypto, explains the machinery behind all three.
- Why does one catalyst move everything at once? Why do crypto prices move together.
- The number everyone quotes and almost nobody uses correctly: what is market cap in crypto.
- New to the major chains? Read What is Bitcoin, What is Ethereum, What is Solana, or What is Cardano.
- Curious how decentralised exchanges fit in? What is a DEX.
See you next Sunday.
A note on financial advice
This brief is for education, not investment advice.
A Fear and Greed reading of 74 means most people are feeling confident. That is historically a worse time to make large decisions than when the same index reads 25, even though it feels considerably better.
The buying underneath this rally is real. So is a 19-year high in bond yields, a near-70% chance of another rate hike, and a market that absorbed a $351 million theft without blinking. Rising open interest means more leverage in the system, which amplifies moves in both directions.
Only invest what you can afford to lose entirely, and make your own decisions based on your own situation.