September 22 is unusually deadline-heavy. The risk map is not dominated by one new nine-figure hack; instead, several previously developing incidents have reached decision points where users can lose execution control, wallet access or recovery options if they miss a cutoff.
The most important security update is Symbiosis’s Bitcoin Bridge post-mortem, which materially changes the evidence quality of an incident CEXVia first covered on September 14. The protocol now attributes the exploit to two interacting software failures: a sender-identification/privilege flaw that let the attacker obtain bridge-administrator treatment, and a negative-fee handling bug that turned subtraction into an effective addition. Twelve abnormal deposits across BNB Chain, Ethereum and Rootstock transformed a 330-satoshi Bitcoin deposit into roughly 46.1 billion unbacked syBTC. Symbiosis now estimates preliminary losses to LPs and affected users at 9.97 BTC. The native Bitcoin Bridge remains offline while the software is rewritten and independently audited.
Read the updated Detail: Symbiosis Bitcoin Bridge Exploit
A second wallet-security problem reaches a hard user decision today. SecondFi, following its June 21–23 signing-key incident that affected 374 wallets and led to approximately 16.1 million ADA being stolen, has warned affected users not to claim NIGHT tokens through their compromised wallets. Midnight’s current Glacier Drop design ties the NIGHT allocation to the original wallet and does not support redirecting the claim to a clean address. SecondFi says the affected wallets remain permanently compromised and its own migration/recovery tools cannot process NIGHT claims.
Read the Detail: SecondFi NIGHT Claim Risk
At the centralized-exchange layer, CoinEx reaches the September 22 phase of its orderly shutdown today. Under the published wind-down plan, all non-spot services are scheduled to cease, most on-chain deposits close, futures orders are cancelled and remaining futures positions are subject to forced settlement using index prices. Earn and staking products are scheduled for platform redemption. The next major cutoff is September 29, when spot trading ends and users who want non-USDT assets in their original form should already have withdrawn them.
Read the updated Detail: CoinEx Shutdown
WOO X also reaches a hard delisting deadline today. CKB/USDT, ICP/USDT and MERL/USDT are scheduled to stop trading at 02:00 UTC on September 22. Deposits close at the same time, while withdrawals remain available only until 02:00 UTC on September 24, after which wallet support is removed. ICP’s collateral ratio has already been reduced to zero. Tokens remaining after wallet removal may be converted to USDT at WOO X’s discretion, but neither conversion nor the exchange rate is guaranteed.
Read the Detail: WOO X CKB/ICP/MERL Delisting
For users affected by The Sandbox’s August bridge exploit, the standard on-chain compensation window closes today at 16:00 UTC. Eligible holders of bridged SAND on Base or BNB Smart Chain are being compensated 1:1 in SAND on Ethereum, based on pre-exploit snapshots. The regular claim deadline is today, although The Sandbox has said late claims can be reviewed case by case through the end of October.
Read the Detail: The Sandbox SAND Compensation
Finally, Russia’s Moscow Exchange launches five crypto-index perpetual futures today: BTCUSDF, ETHUSDF, SOLUSDF, XRPUSDF and TRXUSDF. The contracts are available only to qualified investors, are quoted against the relevant MOEX crypto indexes and are settled in Russian rubles without physical delivery of crypto. The products are economically perpetual but legally structured as one-day cash-settled futures with automatic rollover.
Read the Detail: Moscow Exchange Crypto Perpetual Futures
Two lower-confidence items remain inside the Daily Brief rather than being promoted into standalone Details. Security monitoring reported an RWC token exploit on BNB Smart Chain with an estimated $109,000 extraction, but current public evidence is too thin for a fact-dense long-form page. Binance is also conducting a scheduled wallet-infrastructure upgrade at 06:00 UTC today, temporarily pausing deposits and withdrawals while trading continues; this is routine maintenance, not evidence of an operational crisis.
① Today’s Highest-Priority Alerts
| Risk | Entity | Event | Time | Latest Status | Evidence Type | Continue Monitoring | New vs Previous Day |
|---|---|---|---|---|---|---|---|
| Critical | Symbiosis | Bitcoin Bridge exploit post-mortem | Updated Sep. 21–22 | Dual-bug root cause documented; 46.1B unbacked syBTC; preliminary loss 9.97 BTC; native bridge remains offline | Protocol / Media / On-chain | Yes | Material post-mortem update |
| High | SecondFi / Midnight | NIGHT claim tied to permanently compromised wallets | Sep. 22 claim window | SecondFi says affected users should not claim; NIGHT cannot currently be redirected to a clean wallet | Project / Media | Yes | New recovery-path risk today |
| Critical | CoinEx | Shutdown phase: non-spot cessation / futures settlement | Sep. 22 | Non-spot services scheduled to cease; futures positions subject to settlement; most deposits close | Official / Exchange announcement | Yes | Hard shutdown milestone today |
| High | WOO X | CKB/ICP/MERL delisting and wallet retirement | Sep. 22–24 | Trading/deposits scheduled to stop Sep. 22 02:00 UTC; withdrawals end Sep. 24 02:00 UTC | Official | Yes | Hard trading deadline today |
| Medium | The Sandbox | SAND bridge compensation deadline | Sep. 22 16:00 UTC | Standard 1:1 compensation claim closes today; late case-by-case review available through end-Oct. | Project-reported through Media | Yes | Recovery deadline today |
| Medium | Moscow Exchange | Five crypto perpetual futures launch | Sep. 22 | BTC/ETH/SOL/XRP/TRX index futures launch for qualified investors; cash-settled in RUB | Official | Yes | New regulated market-structure launch |
| Medium / Developing | RWC Token | BSC smart-contract exploit | Sep. 21 | Security monitor estimates ~$109K extracted; root cause/public project response insufficient | On-chain/Security | Yes | New low-fact exploit |
| Low | Binance | Wallet-infrastructure maintenance | Sep. 22 06:00 UTC | Deposits/withdrawals scheduled to pause for about one hour; trading unaffected | Official | Yes | Scheduled operational pause |
② Exchange Exit / Shutdown / Withdrawal Risk
CoinEx — Critical
Today is the second major phase of CoinEx’s shutdown. Users who leave futures positions open lose control over the exit and can be settled at the exchange’s index-price methodology. Non-spot products also move into platform redemption/closure. September 29 remains the more important date for users who want to preserve non-USDT assets in their original form.
WOO X — High
CKB, ICP and MERL move from trading assets into withdrawal-only assets today. After September 24 at 02:00 UTC, even that route disappears. WOO X may later swap residual balances to USDT, but the platform explicitly does not guarantee a conversion or conversion rate.
Binance — Low / Planned
Binance’s wallet-infrastructure maintenance is expected to pause deposits and withdrawals beginning at 06:00 UTC for roughly one hour. Trading remains available. This is not an unexpected withdrawal suspension.
BitMEX — Critical / Continuing
Final exchange closure remains scheduled for September 23. No material independent update today justifies duplicating the existing BitMEX page.
③ Regulation and Licensing
Moscow Exchange — Medium
The five new contracts expand regulated Russian exposure to crypto price movements without allowing physical delivery of BTC, ETH, SOL, XRP or TRX. Only qualified investors can access the products.
The structure keeps collateral and settlement inside traditional exchange infrastructure while referencing global crypto prices. This reduces direct custody exposure but introduces leverage, margin, rollover and basis risk.
④ Hacks / Vulnerabilities / Asset Loss
Symbiosis — Critical
The post-mortem supports a much stronger technical explanation than CEXVia had on September 14. The attacker first obtained unintended privileged treatment through bridge transaction/sender logic, then exploited negative-fee arithmetic. The result was arbitrary unbacked syBTC issuance.
The protocol’s 9.97 BTC preliminary loss is now a better economic-loss reference than the earlier $336,000 attacker-realised WBTC figure. They measure different things: one is estimated LP/user loss, the other one observed monetisation path.
RWC — Medium / Developing
A security monitor reported an approximately $109,000 BNB Smart Chain extraction on September 21. The public record currently lacks the project-side incident accounting and technical depth required for a standalone Detail.
⑤ User Complaints / Operational Anomalies
SecondFi — High
This is a recovery-design problem with real theft risk. Users whose original Cardano wallets are permanently compromised cannot safely use those wallets merely because a new token allocation is available.
Any unofficial “claim migration service” asking for seed phrases, private keys or unknown signatures should be treated as Community / Unverified unless confirmed through official project channels.
⑥ On-chain and Market Anomalies
Symbiosis remains the clearest synthetic-backing anomaly: roughly 46.1 billion unbacked syBTC was created even though only a limited amount of real Bitcoin-linked liquidity was available to extract.
The Sandbox incident remains a bridge-supply integrity case as it enters compensation. MOEX’s launch introduces a separate basis/funding layer because its contracts are dollar-indexed but ruble-settled and auto-roll daily.
⑦ Watchlist
| Date / Window | Event | What CEXVia Is Watching |
|---|---|---|
| Sep. 22 | CoinEx | Futures/non-spot cessation, forced settlement, deposit shutdown |
| Sep. 22 02:00 UTC | WOO X | CKB/ICP/MERL trading and deposits stop |
| Sep. 22 06:00 UTC | Binance | Wallet maintenance and resumption of deposits/withdrawals |
| Sep. 22 16:00 UTC | The Sandbox | Standard SAND compensation claim closes |
| Sep. 23 | BitMEX | Final exchange closure |
| Sep. 24 02:00 UTC | WOO X | CKB/ICP/MERL withdrawals/wallet support end |
| Sep. 25–29 | Balancer | Wind-down governance vote |
| Sep. 29 | CoinEx | Spot closure/non-USDT original-asset cutoff |
| Sep. 30 | UK FCA | Crypto authorisation gateway opens |
| End-Oct. | The Sandbox | Late SAND compensation review period ends |
| Dec. 22 | CoinEx | Final withdrawal deadline |
⑧ No New Development Today, but Still High Risk
D’CENT App Wallet — Critical: multi-chain loss accounting and final root cause remain unresolved. Nostra — Critical: final bad debt, recovery and money-market reopening remain unresolved. ASI / SingularityNET cluster — Critical: key-compromise remediation and unauthorized-supply accounting remain active. Splash / OADA — Critical: recovery, liquidity restoration and compensation remain unresolved. XPR / MetalX — Critical: CEX-bound recovery and final accounting remain incomplete. Liquid Network — Critical: staged bridge recovery remains incomplete. BitMart — Critical: no verified recovery percentage or withdrawal timetable.
FAQ
What is the biggest new security update today?
Symbiosis’s post-mortem, because it now provides a dual-bug root cause and a preliminary 9.97 BTC economic-loss estimate.
Did the Symbiosis attacker steal 46.1 billion BTC?
No. The attacker created roughly 46.1 billion unbacked syBTC units.
Why should affected SecondFi users avoid claiming NIGHT?
SecondFi says the original wallets remain permanently compromised and Midnight currently requires claims through those original addresses.
Is CoinEx completely closed today?
No. September 22 is the non-spot/futures shutdown stage. Spot continues until September 29 under the plan.
Can WOO X users withdraw CKB, ICP and MERL after trading stops?
Yes, but only until September 24 at 02:00 UTC.
Do MOEX crypto perpetual futures deliver actual crypto?
No. They are cash-settled contracts and do not deliver the underlying assets.