H1: Crypto Risk Monitor — September 7, 2026
September 7 is dominated by one exceptionally large bridge/custody event and two platform wind-downs.
The highest-priority incident is Liquid Network. Liquid said on September 6 that roughly 4,000 BTC, worth about $320 million at the time, was withdrawn from the federation wallet backing L-BTC by actors describing themselves on-chain as “whitehats.” The transfer represented roughly 95% of Liquid’s reported BTC reserves before the incident.
Liquid said the withdrawal used the SideSwap Peg-out Authorization Key (PAK) but that the PAK itself and other federation keys were not compromised. The underlying vulnerability remains unexplained publicly. Liquid disabled bridge nodes, exchanges suspended or prepared to suspend L-BTC deposits and withdrawals, and the sidechain was described as effectively paused until the issue is resolved.
This is not yet a confirmed theft. The actors’ “whitehat” claim has not been independently established, and Liquid has not confirmed that the BTC will be returned. CEXVia therefore classifies the incident as:
Critical / Official + On-chain / Developing
Read the detail: Liquid Network 4,000 BTC Security Incident
The second major exchange-risk event is Orionx in Chile. Orionx has begun a permanent shutdown after a forensic review identified more than $7 million in customer assets that had moved to wallets outside the company’s control. Withdrawals are suspended while Orionx attempts to reconcile balances and recover assets.
Chile’s Financial Market Commission has separately stated that Orionx is not registered or authorized by the CMF, that its Fintech Law registration/authorization application was rejected on June 19, 2026, and that the CMF is not supervising the closure or able to order customer restitution.
Orionx has also filed criminal complaints against former executives. Those allegations remain unproven and are treated as allegations only.
Read the detail: Orionx Shutdown and $7M Custody Gap
A third significant wind-down is Router Protocol. The project has announced that it will cease operations by September 30, 2026 after failing to find a sustainable commercial, licensing or acquisition path. Router says it will permanently burn 303,333,198 ROUTE, around 30% of the token’s near-1 billion supply, and coordinate with centralized exchanges as they establish their own delisting and withdrawal schedules.
This is not an exploit-driven shutdown. It is a business-model and infrastructure-economics failure, but it still creates token-liquidity, exchange-support and user-access risk.
Read the detail: Router Protocol Shutdown
AscendEX remains Critical. The September 5 estimated launch date for the customer claims portal has passed. The latest official notice still says September 5 was only a target and that a separate announcement would confirm availability. Withdrawals remain suspended. CEXVia has not found a newer official launch confirmation in the material reviewed for today.
Read the update: AscendEX Claims Portal and Insolvency Risk
Kraken now has another 21-asset delisting cycle approaching. Deposits and trading for XTER, IR, GAIA, SCA, VANRY, BNC, SBR, RBC, MIR, JUNO, HDX, ACA, MULTI, RIZE, EPT, MAT, CQT, CXT, BKS, VULT and M are scheduled to stop on September 11 at 14:00 UTC. Withdrawals remain available until December 10 at 15:00 UTC, after which residual balances are scheduled for liquidation between December 14 and 18.
Kraken warns that liquidation proceeds may be substantially below recent reference prices and can be minimal or nil in thin or inactive markets.
Read the detail: Kraken September 11 Delisting of 21 Assets
Pakistan’s September 5 PVARA NOC deadline has passed. PVARA’s public licensing page still states that transitional operators were required to submit an NOC by September 5 or cease operations, while the online NOC submission page currently says online submission is temporarily unavailable and directs applicants to email the regulator. No official post-deadline list of compliant or non-compliant operators was identified in this run.
① Today’s Highest-Priority Alerts
| Risk | Entity | Event | Time | Latest Status | Evidence | Continue Monitoring | New vs Previous Day |
|---|---|---|---|---|---|---|---|
| Critical | Liquid Network | ~4,000 BTC federation-wallet withdrawal | Sep. 6–7 | ~$320M withdrawn; ~95% of reported BTC reserves; bridge nodes disabled; L-BTC funding suspended at exchanges; root cause unresolved | Official + On-chain + Media | Yes | New highest-priority incident |
| Critical | Orionx | Custody shortfall / permanent shutdown | Sep. 3–7 | >$7M customer-asset gap reported; withdrawals suspended; permanent closure underway; CMF says Orionx was not authorized | Company statements + Regulator + Media | Yes | New CEX custody failure |
| High | Router Protocol | Protocol shutdown | Announced Sep. 5–6 | Operations to end by Sep. 30; 303,333,198 ROUTE scheduled to burn; exchange delistings pending | Project statement + Media | Yes | New infrastructure shutdown |
| Critical | AscendEX | Claims Portal / withdrawals | Sep. 5–7 | Estimated target passed; no newer official launch confirmation identified; withdrawals suspended | Official | Yes | Delay persists |
| High | Kraken | 21-asset delisting | Sep. 11 onward | Trading/deposits stop Sep. 11; withdrawals stop Dec. 10; liquidation Dec. 14–18 | Official exchange | Yes | Next 21-asset cycle approaching |
| High | Pakistan / PVARA | Post-NOC deadline status | Deadline passed Sep. 5 | NOC deadline passed; online submission page temporarily unavailable; no official operator outcome list found | Official regulator | Yes | Post-deadline operational uncertainty |
| High | Vesu / Pragma | Oracle liquidations | Ongoing | Recovery/refund process remains open after 47 positions / ~$3M collateral affected | Protocol + Media | Yes | No major new fact |
| High | GoMining-linked wallets | Suspected coordinated drain | Ongoing | On-chain attribution remains Developing; no final GoMining incident confirmation identified | On-chain + Media | Yes | No major new fact |
② Exchange Exit, Shutdown and Withdrawal Risk
Orionx — Critical
Orionx is no longer simply under stress; it has entered a permanent closure process with customer withdrawals suspended. The critical risk is the mismatch between internal customer balances and assets actually controlled on-chain. Until Orionx publishes final reconciled balances and a restitution framework, users cannot know the eventual recovery percentage or timing.
AscendEX — Critical
The claims portal target is overdue and withdrawals remain suspended. The official notice continues to state that the portal, once available, will not initially support trading, deposits or withdrawals and does not determine claim priority or repayment amount.
Kraken — High
The next 21-asset delisting event reaches its first hard date on September 11. Users retain a withdrawal window through December 10, but after that date execution control transfers to Kraken’s liquidation process.
BitMEX — High
September 23 remains the trading closure date. No new material status change was identified today.
③ Regulation and Licensing
Chile / CMF — High relevance to Orionx
Chile’s CMF says Orionx is not a supervised entity under the Fintech Law. The regulator rejected Orionx’s registration and authorization request on June 19, 2026 and says it is not administering the closure or empowered to order customer restitution.
Pakistan / PVARA — High
The September 5 transitional NOC deadline has passed. PVARA’s public licensing pages still state that transitional operators that did not file must cease operations. The online application page currently reports temporary unavailability and directs applicants to email licensing materials.
Australia ASIC — High
The September 30 digital-asset licensing transition deadline remains active.
UK FCA — Medium / approaching
The UK authorisation gateway opens September 30, 2026 for firms preparing for the mandatory regime that enters force in October 2027.
④ Hacks, Vulnerabilities and Asset Loss
Liquid Network — Critical
This is today’s dominant security event. Roughly 4,000 BTC moved from federation reserves. Liquid says the SideSwap PAK was used but not compromised, leaving the actual failure mechanism unresolved.
Vesu / Pragma — High
No major new factual change: recovery from the September 4 oracle liquidation incident remains ongoing.
Notional Finance — High
No final official post-mortem supersedes the independent loss estimate.
Tectonic — Critical
No final protocol-level loss or bad-debt accounting has been published.
⑤ User Complaints and Operational Anomalies
No new community-only complaint cluster independently met CEXVia’s platform-wide High/Critical threshold.
For Orionx, the shutdown and withdrawal suspension are confirmed by company/regulatory reporting and are not classified as Community.
For AscendEX, rumors about claim percentages, portal availability or recovery priority remain Community / Unverified unless they appear on official channels.
⑥ On-chain and Market Anomalies
Liquid’s reserve movement is the largest material on-chain anomaly today. The key variables are whether the approximately 4,000 BTC remains stationary, whether the actor returns funds, and whether reserve backing for L-BTC is restored.
Orionx represents a different on-chain/accounting anomaly: company books reportedly showed more customer assets than remained under company-controlled custody addresses.
Router Protocol creates token-market risk rather than theft risk. A treasury burn of more than 303 million ROUTE materially changes supply, while exchange delistings can simultaneously reduce liquidity and access.
⑦ Watchlist
| Date / Window | Event | What CEXVia Is Watching |
|---|---|---|
| Immediate | Liquid Network | BTC return, attacker communication, root cause, L-BTC backing, bridge restart |
| Immediate | Orionx | Restitution plan, recoverable assets, legal action, withdrawal treatment |
| Immediate | AscendEX | Claims Portal launch confirmation |
| Sep. 9 | BitMart | Restructuring / resumption roadmap |
| Sep. 11 14:00 UTC | Kraken | Trading/deposits disabled for 21 assets |
| Mid-Sep | Zilliqa | Second exchange migration + retail ZK migration |
| Sep. 23 | BitMEX | Trading closure |
| Sep. 30 | Router Protocol | Operations wind-down |
| Sep. 30 | ASIC | Australia licensing transition deadline |
| Sep. 30 | UK FCA | Authorisation gateway opens |
| Oct. 1 | Holdstation / UNO | Thailand access blocking |
| Dec. 10 15:00 UTC | Kraken | Withdrawal cutoff for 21 assets |
| Dec. 14–18 | Kraken | Forced liquidation window |
⑧ No New Development Today, but Still High Risk
Vesu / Pragma — High: refund and recovery work remains developing.
GoMining-linked wallets — High / Developing: no final official GoMining confirmation or root cause.
Notional Finance — High: no final official post-mortem.
Tectonic — Critical: bad-debt and final-loss accounting remain unresolved.
Coldcard — Critical: attacker clusters remain in an active cross-chain phase.
Aquifer — High: no verified qualifying recovery after the whitehat deadline.
Zilliqa — Critical: retail migration and compensation governance remain pending.
BitMart — Critical: September 9 remains the next major stated milestone.
FAQ
What is the biggest crypto risk event today?
Liquid Network’s roughly 4,000 BTC federation-wallet withdrawal is the largest and most systemically important event in this report.
Was Liquid’s 4,000 BTC definitely stolen?
Not yet confirmed. The actors called themselves “whitehats,” Liquid has not confirmed the funds will be returned, and the root cause remains unresolved.
Is Orionx still allowing withdrawals?
No. Orionx has suspended withdrawals during its permanent shutdown and asset-restitution process.
Was Orionx regulated by Chile’s CMF?
The CMF says Orionx was not registered or authorized and that its June 2026 application was rejected.
When does Router Protocol shut down?
The project says operations will end by September 30, 2026.
What is Kraken’s next forced-liquidation risk?
Trading and deposits for 21 assets stop September 11; withdrawals close December 10 and residual balances are scheduled for liquidation December 14–18.