Web3 Industry Weekly Report: Highlights from Week 5 of September 2026
Tech Headlines
1. Bitget Hot Wallet Hacked for Approximately $351.6 Million, Preliminarily Determined to Be a Supply Chain Attack Rather Than a Private Key Leak
In the early hours of September 25 (02:31 Beijing time), Bitget detected abnormal transfers from its hot wallet, and CEO Gracy Chen confirmed within hours that the loss amounted to approximately USD 351.6 million. The affected scope was limited to the hot wallet and some warm wallets, while cold wallets remained secure; withdrawals were suspended, but deposits and trading continued to operate. According to CoinDesk, preliminary assessments indicate this was a supply chain attack: what was manipulated was not Bitget's core key system, but rather, after infiltrating its third-party tools, the attackers forged transfer information and triggered the signature authorization process to move funds out, making insider involvement less likely. On-chain data shows that the attacker rapidly swapped stablecoins for ETH (stablecoins can be frozen, whereas ETH has no such mechanism), a method similar to previous large-scale exchange hacks, though the relevant attribution has not yet been officially confirmed. Bitget stated that its user protection fund holds over USD 464 million, sufficient to cover this loss. This incident once again demonstrates that an exchange's security perimeter has extended beyond its own key management to encompass third-party supply chains and signature authorization pipelines.
2. Payy's Ethereum Cross-Chain Bridge Contract Drained, All Balances Stolen and Trading Suspended
https://x.com/payy_link/status/2103123293687419136
On September 24, the privacy stablecoin payment network Payy Network reported that its cross-chain bridge contract on Ethereum (the rollup contract used for batch settlement of the Payy network on Ethereum) was exploited by an attacker at 4:21 UTC that day, draining the entire balance. All network transactions (deposits, withdrawals, transfers, and bank card transactions) and Wallet functions were suspended. According to on-chain records (compiled by Unchained), the stolen assets totaled approximately USD 1.92 million in USDC, transferred out in two batches via the verifyRollup interface used for Payy's routine batch crediting (approximately USD 1.828 million at 4:21 UTC and approximately USD 90,000 at 9:30 UTC). The receiving address had seen small test inflows and outflows in the days prior to the incident; the first batch was swapped for approximately 683 ETH via UniswapX within about 8 minutes and dispersed to three addresses. On September 25, Payy stated that a preliminary root cause analysis had been completed: this incident was not caused by a private key leak, social engineering, or a compromise of off-chain infrastructure. The relevant conclusions are being verified by a leading audit firm, and the verified report will be published within a few days. The stolen assets were user non-custodial deposits, and compensation arrangements and the network restart timeline have not yet been announced. This incident highlights the typical risk surface of cross-chain bridge infrastructure: the attack did not target users' private keys, but occurred at the protocol's own bridge interface. The aggregated liquidity carried by cross-chain bridges and their privileged invocation interfaces constitute the primary exposure surface.
Industry Dynamics
1. European Central Bank Launches Blockchain Settlement Service Pontes, Bringing Central Bank Money to On-Chain Financial Markets
https://www.ecb.europa.eu/paym/target/pontes/html/index.en.html
On September 21, the European Central Bank launched a new service named Pontes, connecting its TARGET payment system with blockchain financial markets. This allows banks and investors to settle on-chain transactions using central bank-backed euros rather than relying on stablecoins or privately issued money. According to Reuters, Deutsche Bank, Santander, and the clearing house Clearstream have completed integration, with the platform initially operating from 8:00 to 16:00 CET on business days. The ECB also officially announced that it will invest a small portion of its approximately EUR 23 billion in proprietary funds into on-chain securities, focusing on high-rated euro-denominated bonds issued by public institutions. Pontes adopts a two-tier model of "cash tokens plus T2 final settlement" and uses the Hash-Link protocol to achieve cross-platform atomic settlement for processes requiring all-or-nothing execution, such as DvP. Previously, ECB Executive Board member Isabel Schnabel stated that central banks should go "on-chain" to reduce reliance on private alternatives, and the Swiss National Bank and the Bank of England are also advancing similar blockchain settlement projects.
2. Hong Kong Monetary Authority: CMU to Launch 24-Hour On-Chain Real-Time Settlement by Year-End, Exploring Acceptance of Tokenized Deposits and Regulated Stablecoins
In his address at the Treasury Markets Summit 2026 on September 23, Hong Kong Monetary Authority (HKMA) Chief Executive Eddie Yui Wai-man stated that Hong Kong's equity, foreign exchange, and bond markets are mature and digital finance is rapidly emerging. The Central Moneymarkets Unit (CMU) will launch new services by year-end, providing 24-hour on-chain real-time settlement and supporting the e-HKD and central bank digital currencies (CBDCs). It will also explore accepting tokenized deposits and regulated stablecoins for settlement on the platform. These measures aim to reduce transaction costs, enhance price discovery and settlement efficiency, strengthen cross-border connectivity, and promote an active secondary market. Yui also noted that Hong Kong accounted for approximately half of global digital bond issuance in the first half of the year. The HKMA will support the government in regularizing digital bond issuance and pilot the tokenization of Exchange Fund Bills. On the same day, Hong Kong Legislative Council member (Technology and Innovation constituency) Duncan Chiu Tat-kun stated at the same summit that Hong Kong will submit a bill to the Legislative Council within the year regarding the regulatory framework for four categories of service providers: virtual asset trading services, custody services, advisory services, and management services. By then, Hong Kong's licensing requirements related to digital assets will be largely clarified.
3. European Securities and Markets Authority (ESMA) Establishes EU-Level "Digital Innovation" Strategic Supervisory Priority, with AI and Tokenization as Initial Focus from 2027
On September 23, ESMA announced that starting in 2027, it will establish a Union Strategic Supervisory Priority themed around digital innovation. Working in collaboration with national regulators, the initial focus will be on the use of AI and tokenization by regulated entities. National competent authorities will identify emerging areas of tokenization, document firms' use of AI and tokenization in products and processes that directly impact investors, and conduct preliminary inspections of some of the most affected firms. Key risks highlighted in the official factsheet include biased or misleading AI outputs, products that are difficult for investors to understand, and reliance on a small number of third-party service providers. This theme will be advanced in parallel with the cyber and operational resilience priority launched in 2025, indicating that EU regulation of AI and tokenization has entered a unified and coordinated routine supervisory framework.
4. Canada's Six Major Banks Jointly Explore CAD Tokenized Deposit Solution
https://www.rbc.com/newsroom/news/article.html?article=126151
On September 22, the Bank of Montreal (BMO), Canadian Imperial Bank of Commerce (CIBC), National Bank of Canada, Royal Bank of Canada (RBC), Scotiabank, and TD Bank announced that they will jointly explore the development of a Canadian dollar-based tokenized deposit solution. The first-phase goal is to enable tokenized deposits to flow efficiently among Canadian financial institutions, while the long-term goal is to interconnect with other emerging digital asset projects to provide faster, more efficient, and programmable payment services. Related testing is currently underway, and more banks may join in the future. Canadian banking regulators have previously stated that tokenized deposits are not legally distinguished from traditional deposits, providing a clear regulatory foundation for the project. Following Project Samara, which completed the settlement of a CAD 100 million tokenized bond earlier this year, this is Canada's second-largest wholesale-level tokenized finance project.
In-Depth Analysis
1. Vitalik on the "Cryptographic World Computer": The Paradigm Shift from the Bitcoin Whitepaper to Ethereum
https://www.panewslab.com/zh/articles/01a0e702-e3ef-74f6-b91e-570a61e8dc03
Ethereum is evolving from a traditional blockchain into a "cryptographic world computer," representing a fundamental transformation. Based on Vitalik's speech at Shanghai Blockchain International Week, this article systematically compares the differences between the Bitcoin whitepaper and Ethereum across core dimensions such as verification mechanisms, consensus mechanisms, and block construction, while also outlining the roadmap for the next three to ten years.
Disclaimer: The information provided in this document is based on publicly available market data and industry trends, and is for reference only. Please note that this information does not constitute any form of investment advice or recommendation, nor should it be considered as the basis for buying or selling any financial products or services. In case of any translation errors in English, inaccuracies, or situations requiring further clarification, please contact us through 'Contact Us' so that we can verify and make necessary corrections in a timely manner.
About ZAN
ZAN is a reliable Web3 and AI brand under Ant Digital Technologies, dedicated to enabling business innovation with secure, scalable, and high-performance infrastructure services.
With a dual-track product strategy across Web3 and AI, ZAN provides foundational infrastructure for developers and enterprises building next-generation digital applications. On the Web3 side, ZAN offers ZAN Node Service and ZAN ZK Acceleration to support blockchain access, scalability, and zero-knowledge computing. On the AI side, ZAN provides ZAN Router to help enterprises route, monitor, and scale AI integrations.