Crypto Risk Monitor — September 24, 2026

September 24 opens with a sharply different risk profile from the previous session. The largest new security event is not a private-key theft or a smart-contract arithmetic bug, but a governance capture on Neutron that allowed one voting address to take administrative control of contracts belonging to Astroport and Drop. The incident then spilled into the wider Cosmos ecosystem: Neutron halted, Cosmos Hub validators deliberately stopped the Hub for nearly 25 hours to contain stolen ATOM, and the first block after the Hub restart moved approximately 1,227,121 ATOM away from the attacker-linked address without a normal transaction signed by that wallet.

Current public reconstruction places approximately $9.4–$9.5 million of assets inside the Neutron attack path. Only around one-fifth appears to have escaped before chains were halted; the remainder was trapped or subjected to recovery intervention. These figures should be treated as gross affected/drained estimates, not a final protocol-wide realized loss. Cosmos Hub itself was not exploited: the Hub halt was a defensive response to assets that had moved from Neutron.

Read the Detail: Neutron Governance Attack and Cosmos Hub Halt

The second major development is a much more authoritative accounting of the Liquid Network September 6 incident. Blockstream published its formal security incident assessment on September 23. The report confirms that an Elements rangeproof-verification cache bug allowed approximately 4,000 unbacked LBTC to be created, after which SideSwap’s peg-out path released almost 4,000 real BTC. The attackers later returned 3,400 BTC; the latest official figure says approximately 602 BTC remain outstanding.

The official post-mortem also replaces several earlier assumptions. The incident did not come from a stolen Federation signing key. A previously reported cache-key flaw had been patched, but the patch itself introduced a second byte-boundary collision issue because variable-length fields were concatenated without safe length framing. SideSwap’s Peg-out Authorization Key was not forged; instead, operational controls around its online peg-out key allowed the fraudulent LBTC to be converted into a very large BTC payout without sufficient size/velocity review. The current corrected Liquid chain contains no remaining inflation from the two identified bugs. Peg operations remain in staged recovery.

Read the updated Detail: Liquid Network 4,000-LBTC Incident

Centralized exchanges create three hard access risks today.

First, Binance ends all USDP spot trading at 03:00 UTC on September 24. Binance Convert support is scheduled to end one hour earlier at 02:00 UTC. Deposits of USDP stop being credited after September 25 at 03:00 UTC, while withdrawals remain available until November 24 at 03:00 UTC. After November 25, Binance may convert remaining USDP to other stablecoins on users’ behalf, but conversion is not guaranteed. The exchange has not said the delisting reflects a USDP depeg, reserve shortfall or Paxos insolvency event; CEXVia therefore treats this as a market-access and execution risk, not a stablecoin solvency finding.

Read the updated Detail: Binance USDP Delisting

Second, WOO X removes CKB, ICP and MERL wallet/withdrawal support at 02:00 UTC today under the delisting timeline CEXVia covered yesterday. Users who want the original tokens have reached the final platform exit window. Because this is the same event and yesterday’s Detail already captured the facts, CEXVia does not create another URL today.

Third, OKX TR has announced a regional delisting of DORA, ICX, STORJ, ZEUS and ELF. Deposits for all five were suspended at 10:00 UTC on September 23. USDC/EUR pairs for ICX, STORJ and ELF are scheduled for removal September 30, while the relevant USDT pairs and DORA/ZEUS markets are scheduled for October 3. Withdrawals remain available until December 23 at 08:00 UTC. This is an OKX TR regional decision, not a global OKX delisting. ICX is notable because its exchange access has also been contracting at other venues, but multi-venue delisting should not be automatically rewritten as a network failure.

Read the Detail: OKX TR DORA/ICX/STORJ/ZEUS/ELF Delisting

Finally, BitMEX is now in post-closure mode. Trading ended September 23 at 04:00 UTC and all remaining positions were closed under the shutdown process. The website remains available for balance review and withdrawals, but new deposits are no longer credited. On September 28 at 04:00 UTC, API withdrawals—including integrations such as Fireblocks and Copper—are scheduled to stop, and USDT/USDC/ETH withdrawals will be restricted to Ethereum rather than multi-network fungibility. A newer BitMEX support article states that account service fees will begin October 1, with applicable rates communicated by email. CEXVia uses that latest official timing instead of repeating older fee wording.

Read the updated Detail: BitMEX Shutdown: Post-Closure Withdrawals

No new regulator enforcement action in the last scan exceeds these five items on factual depth and search value. Yesterday’s Binance Iran sanctions investigation, CFTC event-contract advisory and European stablecoin/MiCA policy work remain important, but there is no verified material change today that justifies duplicating those pages.

① Today’s Highest-Priority Alerts

② Exchange Exit / Shutdown / Withdrawal Risk

Binance USDP — High / Immediate

The immediate risk is not whether USDP exists after September 24. The risk is that Binance’s market and conversion routes disappear in stages.

At 02:00 UTC, Binance Convert support is scheduled to end. At 03:00 UTC, all USDP spot pairs and related Trading Bots end. A user waiting until after those cutoffs no longer has the same Binance execution paths.

Deposits have a later operational cutoff: USDP deposits sent after September 25 at 03:00 UTC are not scheduled to be credited. Withdrawals continue much longer, until November 24 at 03:00 UTC.

This is not evidence that USDP lost its dollar peg or that Paxos reserves are deficient.

WOO X — High / Final Withdrawal Cutoff

CKB, ICP and MERL trading already ended. Today at 02:00 UTC, withdrawals and wallet support are scheduled to end as well.

WOO X said residual assets may later be converted to USDT, but the conversion itself and the exchange rate are not guaranteed.

OKX TR — High / Regional

DORA, ICX, STORJ, ZEUS and ELF deposits are already suspended on OKX TR.

The next dates are September 30 and October 3 for spot-pair removal, followed by a December 23 withdrawal cutoff. Bot users also face staged automatic closure unless they stop bots manually.

The scope is OKX TR. It must not be expanded into “OKX globally delists all five tokens.”

BitMEX — High / Withdrawals Only

BitMEX trading has ended. Deposits after the September 23 closure time are not credited and BitMEX says they are not recoverable.

Withdrawals remain available through the website. The next important deadline is September 28 at 04:00 UTC:

• API withdrawals stop;
• Fireblocks/Copper withdrawal integrations stop;
• USDT, USDC and ETH lose multi-network withdrawal fungibility and become Ethereum-only on BitMEX.

The latest BitMEX fee guidance says account service fees begin October 1 and the applicable rates are communicated to users by email.

CoinEx — Critical / Continuing

September 29 remains the next major deadline for spot closure and for users seeking to withdraw non-USDT assets in original form.

③ Regulation and Licensing

No new regulator action in this scan exceeds the independent-Detail threshold.

The most important unchanged regulatory risks remain the U.S. investigation into Binance’s potential Iran-sanctions exposure, CFTC scrutiny of manipulation-prone mention markets, European debate over future MiCA stablecoin liquidity design and the UK FCA authorisation gateway opening September 30.

The lack of a new regulator Detail today is deliberate: repeating yesterday’s background without a new official action would violate CEXVia’s “new progress only” rule.

④ Hacks / Vulnerabilities / Asset Loss

Neutron — Critical

The attack is a reminder that governance itself can be an exploit surface.

A voting account reportedly acquired and staked approximately 31.6 million NTRN shortly before an expedited vote closed. The proposal contained 11 execution messages that transferred administrative control over contracts to the proposer-controlled address. Ten contracts associated with Astroport and Drop were then migrated or drained.

The result was not merely a bad vote. Governance permissions on the chain could override application-level control in ways users of those protocols did not expect.

Liquid Network — Critical, Recovery Improving

Blockstream’s official assessment clarifies the root cause and updates the amount still outstanding to approximately 602 BTC.

It also shows why the incident was both a software-security failure and an operational-control failure:

• the rangeproof verification cache accepted an invalid confidential output;
• the first remediation approach created a second collision class;
• SideSwap’s peg-out path could release a very large BTC amount without sufficient human review or size controls.

The corrected Liquid chain no longer contains inflation caused by the identified bugs, but reserve recovery and peg restoration are not complete.

⑤ User Complaints / Operational Anomalies

No new Community-only complaint cluster independently meets CEXVia’s High/Critical publication threshold today.

Users around shutdown/delisting events remain especially exposed to support impersonation. BitMEX has warned about recovery scams; Liquid/Blockstream has separately warned users not to enter recovery phrases, install unsolicited “security updates” or send funds to obtain reimbursement.

Any community claim that asks for a seed phrase, private key, remote access or an advance recovery fee should remain Community / Unverified unless verified through official support channels.

⑥ On-chain and Market Anomalies

The most consequential chain-level anomaly is the Neutron governance event because it crossed protocol boundaries and forced two chain-level containment decisions: Neutron’s own halt and the Cosmos Hub validator halt.

The first block after Cosmos Hub’s restart moved approximately 1.227 million ATOM out of the attacker-linked address without the normal wallet signature path. That intervention improves recovery prospects but also creates a governance/finality question: users and applications must understand under what emergency conditions validators can coordinate state changes to contain stolen funds.

Liquid presents a different invariant failure. Roughly 4,000 LBTC could be created without backing even though the Federation signing threshold itself had not been compromised. The corrected-chain replay shows why consensus validation—not merely multisig custody—is part of a Bitcoin sidechain’s reserve model.

⑦ Watchlist

⑧ No New Development Today, but Still High Risk

D’CENT App Wallet — Critical: final root cause, vulnerable-version mapping and multi-chain loss accounting remain unresolved. Nostra — Critical: final bad debt, recovery and full money-market reopening remain unresolved. ASI / SingularityNET cluster — Critical: compromised-authority remediation and unauthorized-mint accounting remain active. Splash / OADA — Critical: recovery, liquidity restoration and compensation remain unresolved. XPR / MetalX — Critical: CEX-bound asset recovery and final accounting remain incomplete. BitMart — Critical: no verified recovery percentage or withdrawal timetable.

FAQ

What is today’s most important new security event?

The Neutron governance attack, because a governance vote transferred contract-admin control, caused roughly $9.4–$9.5 million of gross asset exposure and triggered defensive halts on Neutron and Cosmos Hub.

Was Cosmos Hub itself hacked?

Current Hub statements and reporting say no. Validators halted the Hub to contain ATOM that had moved from the Neutron attack.

How much BTC is still outstanding from the Liquid incident?

Blockstream’s September 23 assessment says approximately 602 BTC remain subject to recovery efforts.

Is Binance delisting USDP because Paxos is insolvent?

Binance has not established that. The current event is a Binance listing/support decision, not a confirmed Paxos solvency event.

Is OKX globally delisting DORA, ICX, STORJ, ZEUS and ELF?

The September 23 announcement covered OKX TR.

Can BitMEX users still withdraw after the exchange closed?

Yes. Website withdrawals remain available, but API withdrawals and multi-network options for USDT/USDC/ETH narrow on September 28.