[SECURITY NOTICE] Bitget Hot Wallet Incident — September 24, 2026 At 18:31 UTC on September 24, 2026, Bitget's security systems detected unauthorized transfers from some of our hot wallets. Our security team activated emergency response protocols immediately. What we have confirmed: -Estimated funds affected: approximately $351.6 million -Cold wallets remain fully secure. Bitget operates a three-tier wallet architecture — the breach contained only a portion of the hot wallet and warm wallet layers. -User funds are safe. The full amount of this loss falls within the coverage of Bitget's User Protection Fund, which currently holds over $464 million Actions we have taken: -Emergency response team activated within minutes of detection -Abnormal transfer addresses identified, flagged, and reported -Withdrawals temporarily suspended as a precautionary measure, pending security review -Law enforcement and on-chain security firms have been formally notified and are engaged What this means for you: -Your account balances are accurate and your assets are protected -Deposits and trading remain fully operational Withdrawals are temporarily paused and will be restored as soon as the security review is complete -What comes next: We will provide updates on an hourly basis across this channel and all official platforms. A full incident report — including root cause analysis and corrective actions — will be published within 24 hours. We will not speculate on the attack vector until the investigation is complete. Bitget has navigated multiple market cycles. We will not run from this. Every dollar and every decision will be accounted for, transparently and in full. Updates will be posted here and across all official Bitget channels as they become available. — Gracy Chen, CEO, Bitget

Security researchers are warning iPhone users about a potential Safari zero-day exploit that could put sensitive data at risk. The reported attack could allow hackers to target cryptocurrency private keys, recovery phrases, and information stored in Apple’s Keychain. If you use an iPhone, check for the latest iOS update and install it as soon as possible, The warning reportedly covers iOS versions ranging from 13 to 26.5

Security in heyAura starts with how wallet context is handled. Local processing, continuous code review, user-approved actions, and verifiable identity all contribute to the security model behind the product. Explore heyAura's security approach ↓

Security and IP implications of AI The case for rapid AI deployment - I think we can all conclude the following from the last few months of developments - 1. Not using AI could and will become an existential issue for both individual users and enterprises. 2, Enterprise adoption will be cautious while individual users are definitely going to race ahead, try different use cases, build agents, push the models to their limits (although it seems harder to do, unless you live in an AI Lab) 3. Employees and developers will take matters in their own hands since they will find their cautious enterprises aren't moving fast enough. 4. Agents are showing their prowess, uncontrolled, unrestrained agents with a "capture the flag mentality" are showing us the edge cases which demonstrate the negative outcome possiblities of these scenarios. 5. It is impossible to plan for the next 6 months since we can't fathom where technology will evolve to. These activities will cause adoption sans security..... AI has deep implications on security in the future. In this environment security companies need to live on the bleeding edge, anticipating scenarios, building framework solutions so we have a shot at securing future outcomes. Which we all are. Some useful pointers to people planning their AI implementation: 1. Secure what you plan to use, try not to secure the future - no products for security can be created unless we see the future unfold. The future is moving fast, so are we. 2. Most of the coding usage is unsecured. Make sure your coding is secure. Most enterprise AI apps do not offer a secure instance (this is your IP living in their instance)! SECURE your codex, cursor, Claude code Harvey, glean, legora instances now! 3. Do not try and build your own - I have already experienced enterprise customers building gateways and tools for agents - security companies have thousands of specialists working on this, leverage them, Focus on AI adoption instead. Partner to secure. 4. Securing agents is a complex problem - securing the agentic lifecycle - real time inspection and kill switches are key. Don't fall in the discovery and posture trap (Visibility - process understanding - intent interpretation - ability to stop inline are key tenets to the agentic lifecycle - not identity, posture and inventory - those are mere building blocks) 5. Only use enterprise protected models, single tenant, firewalled, inspected implementations - this is your IP you are playing with - LLMs have shown they will cross boundaries to capture the flag - you think your IP is safe? Once you train an unprotected model with your IP - you can't reverse the trade. 6. Perhaps the most important one - do not use a security tool built by the same person who is selling you the AI implementation, historically IT vendors are different from security vendors. You need an enterprise solution for security and it must work on your diverse infrastructure. Use a pure play security partner. Happy building with AI.

Security Notice & Phishing Alert Following the recent Liquid Network incident, scammers are impersonating Liquid and Blockstream and urging users to "take action." Don't. Blockstream will never ask for your recovery phrase or PIN, ask you to send funds, or provide a link for updated software. Never - Send funds to a "recovery" address Never - Enter your seed on a "migration" site Never - Install firmware or software from an email link Never - Reply to unsolicited DMs Treat as scams: "mandatory security update" emails and portals, refund / re-peg / "claim L-BTC" sites, fake support DMs, lookalike domains, and unsolicited "white-hat" or bounty outreach. For verified updates, go only to or the official Blockstream app from the official app stores.

Security and compliance will unlock future adoption. Outside scrutiny is the best way to test our defenses. To that end, we’ve received a Big Four independent review that confirmed our AML/CFT controls are capable of managing financial crime risk.