Block wants Bitcoin to handle the tiny payments AI agents make while getting things done online.

The company announced on September 24 that it had joined the x402 Foundation and contributed Lightning payments to the protocol. Its announcement puts Bitcoin into an open standard for software that can request and pay for services. Block sees fast, inexpensive transactions as essential to that market. The development gives Bitcoin holders a practical adoption story to follow beyond the next price target.

The proposed customer is often a program acting for a person or business. Think of an agent paying for a piece of data it needs to complete a task. The payment could happen within its interaction with the service, without a person stepping through a checkout each time. That is the kind of repeated, small transaction Block is targeting. It is also a very different use of Bitcoin from parking a large balance in a treasury.

A payment request built into the web

The standard uses HTTP 402, the web's Payment Required response. A service receiving an unpaid request can return instructions for payment. The client pays and retries, allowing the service to deliver the requested resource. The x402 project describes applications including paid API access and digital content. Developers can support multiple networks or payment schemes through the same framework.

That flexibility is part of the significance of Lightning joining. The standard is designed to work across currencies and networks, under Linux Foundation governance. Block's contribution adds another way to settle payments inside it. Businesses still need to build services that accept the method, and users need software capable of paying that way. A supported payment option only becomes useful when the two sides actually meet.

The demand still has to show up

At the time of review on September 25, x402's website displayed 75.41 million transactions and $24.24 million in volume for the previous 30 days. Those are figures for the overall protocol. They cannot be counted as activity generated by Block's new Lightning contribution. Block's announcement did not provide a separate Lightning transaction total or a consumer-product rollout date. It would be premature to treat its participation as evidence that millions of agents are already spending bitcoin through the integration.

Block says it will keep contributing to Lightning support and the foundation's working groups. It also plans further tools for agent-driven commerce. The useful test now is whether developers turn that work into services people repeatedly use. Watch for named deployments and payment activity that can actually be attributed to Lightning. The technology has a new route to customers; sustained use will tell us how much that route matters.

Bitget's hack just got more expensive, and customers are still waiting for a withdrawal update.

The exchange raised its estimate to $387.5 million in a September 25 update, replacing the earlier $351.6 million figure. It attributed the difference to previously uncounted Zcash and TRON transfers. Bitget said the revision reflects better accounting of the original incident, not another attack. That distinction matters when an already substantial loss grows overnight.

The original alarm came at 18:31 UTC on September 24, according to Bitget's security notice. The company said only part of its hot and warm wallet infrastructure was affected and its cold wallets remained secure. It paused withdrawals while keeping deposits and trading open. Bitget also said account balances remained accurate. Customers therefore face a separation between what their accounts show and their ability to move those assets elsewhere.

The investigation points beyond stolen keys

CEO Gracy Chen has described a compromise of a backend wallet service, according to Cointelegraph. Her account was that attackers forged transfer information and triggered the authorization-signing process. She said the preliminary investigation did not point to leaked private keys. That would put the weakness in the systems instructing transfers, rather than possession of the keys alone. A complete technical explanation is still important before treating that account as the final root-cause finding.

Chen also raised the possibility of North Korean involvement, citing IP and VPN patterns resembling those associated with a North Korean group. That is a preliminary attribution by the exchange's chief executive. It should not be presented as an independently established identity for the attacker. Mandiant and SlowMist are assisting the investigation, Bitget said. For affected customers, identifying the perpetrators and restoring access are separate problems, even when both are being worked on at once.

A coverage promise still needs an operational recovery

Bitget's original notice said its User Protection Fund held more than $464 million and covered the incident. That was the exchange's assurance about its own resources. It does not mean the stolen assets have already been returned. The September 25 update says some funds have been frozen and introduces conditional 5% bounties for eligible freezing or recovery work. Freezing funds and returning them to the exchange are different stages of that process.

Bitget says it has fixed the vulnerability and is validating security before restoring withdrawals. It promises an announcement about withdrawal status or timing by September 26 at 04:00 UTC. That is a deadline for information, not a guaranteed reopening time. The next useful evidence is a clear service update followed by withdrawals actually working again. Until then, the larger loss estimate and the coverage pledge should be read alongside the access restrictions customers still face.

Wall Street shares are getting a new route onto crypto trading infrastructure, but the companies behind those shares still get a say.

The SEC issued its Innovation Exemption on September 17, giving qualifying venues a temporary path to trade tokenized U.S. stocks through automated market makers and liquidity pools. Its announcement sets a five-year expiry after publication. The relief covers specified exchange and dealer requirements, subject to conditions. For crypto traders, the immediate significance is a defined framework for bringing familiar stock exposure into an onchain trading environment.

The SEC calls the operators Tokenized Securities Venues, or TSVs. They provide the pools and decide who can access trading. Commissioner Hester Peirce said the exemptions are available to U.S. persons, including established businesses and newcomers. She described the move as an interim step that will help regulators observe how blockchain markets and traditional markets interact. Her statement also makes clear that this framework addresses one particular trading model, leaving room for other approaches.

A stock token has to come with shareholder rights

The venues must verify that qualifying tokens give holders the same rights and privileges as the equivalent traditional shares. That matters because a token tracking a share price can sound deceptively similar to owning the share itself. The SEC's order excludes third-party securities that merely provide synthetic exposure to another security. It also prohibits primary issuance and initial offerings on these venues under this exemption. Traders will need to look at what a product actually represents before treating a familiar ticker as proof of ownership.

Companies also have a way to refuse certain listings. If a token was created by an unaffiliated third party, the venue must notify the underlying stock's issuer and wait at least 30 calendar days after receipt. A written objection delivered within that window prevents the venue from making that token available for trading. Separately, a venue must publish its own operational notice at least 30 calendar days before starting. Those waiting periods mean the announcement does not translate into an instant menu of every U.S. stock in your wallet.

Public blockchains, controlled access

The design combines public infrastructure with permissioned trading. Smart contracts must be public and auditable, and operate on a public, permissionless distributed ledger. The venues still set entry standards for participants using their pools. They must also stop trading a tokenized stock when its underlying stock is halted or suspended on the primary listing exchange. Moving the trade onchain does not make those market stoppages disappear.

Commissioner Mark Uyeda highlighted limits on the number of symbols and trading volume, along with public transaction data intended to make activity easier to monitor. He said the framework would give the agency practical evidence for future policymaking. That leaves a concrete test for the businesses pursuing this market: attract usable liquidity while meeting the conditions. For readers, the next developments worth watching are actual venue notices and the stocks those venues can support. The SEC has supplied a route forward; which shares become available, and how well they trade, will determine how useful it is.

The password you reused years ago could give someone a route into your crypto account today.

Singapore police warned on September 12 that they have seen an increase in unauthorised access to cryptocurrency accounts through compromised email since mid-August, according to CNA. Investigators found that several affected email accounts had appeared in earlier data breaches on other platforms. Police said exposed credentials and password reuse may have helped attackers gain access. The warning concerns account takeovers, and does not establish that an exchange's own systems were breached.

Once inside an inbox, attackers may be able to work out which crypto services its owner uses. Police described the possibility of password-reset requests followed by interception of reset links, verification messages or one-time passwords delivered by email. They also warned that intruders may alter inbox rules to hide exchange messages by forwarding, archiving or deleting them. That makes a quiet inbox a poor substitute for checking the account itself. A notification cannot warn you if someone has arranged for you never to see it.

The inbox deserves the same attention as the exchange

The practical issue is how much authority your email account has over your other accounts. If it receives recovery links, access to that mailbox can become part of the route to changing a login. Reusing a password creates another connection between services that might otherwise have little to do with each other. An old breach at one website can therefore remain relevant long after you stopped using that website. The police's wording leaves room for differences between individual cases, so this should not be read as a claim that every exchange can be unlocked with email alone.

The warning follows a separate August 21 police advisory about criminals allegedly impersonating Apple support to steal cryptocurrency. In that scheme, police said victims were directed to fraudulent websites and asked for login details and one-time passwords. The reported sequence included unexpected device prompts and unsolicited calls claiming that an account was compromised. Police recorded at least five cases after August 7 in that earlier warning. Those were separate incidents, but they illustrate why an urgent offer to secure an account also needs checking through the provider's official channels.

Check the settings that can hide a takeover

For the latest warning, police recommended unique passwords and multi-factor authentication, with an authenticator app preferred over SMS where available. Their advice also included reviewing email forwarding rules and suspicious login activity. Crypto users were urged to inspect transaction history and enable activity alerts where supported. That review needs to include the mailbox receiving those alerts. Security settings on the exchange are only part of the picture when account recovery depends on another service.

Anyone who suspects a compromise should contact both the email provider and the crypto exchange promptly, police said, asking them to secure or freeze affected accounts where possible. Password changes should cover the affected accounts and other services where the same password was used. A suspicious login or unexplained forwarding rule deserves attention even before you spot an unfamiliar withdrawal. The useful response to this warning is to check your recovery route while you still control it. Start with the inbox that receives your exchange emails.

Nasdaq is putting $100 million behind Kraken's parent company, with tokenized stock trading on the agenda for 2027.

The exchange operator announced the investment agreement with Payward on September 10. Its venture arm will make the investment as the companies expand an existing partnership. Their Nasdaq Equity Tokens, or NETs, are expected to launch in the second quarter of next year. For traders accustomed to crypto markets that never close, the attraction is easy to understand: bringing more of that flexibility to stocks.

The companies still have work to do before that becomes a product traders can use. Nasdaq's announcement describes an agreement to invest and an expected launch date. It does not announce that NET trading has opened today. The distinction matters when a headline combines a familiar Wall Street name with a large dollar figure. A development timetable is useful information, but it is not a completed rollout.

A bigger role for Kraken's parent

The deal values Payward at $21 billion, according to Bloomberg reporting cited by CNBC. That figure is a reported valuation of the company, separate from Nasdaq's $100 million investment. CNBC places the agreement within Kraken's expansion into a broader platform spanning traditional financial products as well as crypto. The distinction is relevant to readers who see every institutional crypto headline as a fresh purchase of Bitcoin. This transaction concerns an ownership investment in a business building trading infrastructure.

The partnership also reaches the systems used to monitor trading. Payward plans to adopt Nasdaq's surveillance technology across its venues, covering crypto and traditional asset markets. Surveillance is less glamorous than a new token launch, but it is part of how venues look for suspicious activity. Adding technology does not, by itself, establish that misconduct cannot happen. Customers will still need to judge the venues and products they use on their actual operation.

What will the token actually give you?

One issue deserves as much attention as the launch date: the rights attached to the token. CNBC describes a wider dispute over tokenized stocks, including a clash between Robinhood and AMC over products referencing AMC shares. Economic exposure to a share price and shareholder rights are different questions. Nasdaq says its framework is designed to preserve protections for issuers and investors. Readers should check the eventual product terms rather than assume that every instrument called a tokenized stock works the same way.

For now, the concrete development is a major exchange operator committing capital to its partnership with a crypto company. The commercial opportunity depends on turning that relationship into a service people can actually access and use. The next useful details will concern launch availability and the terms offered to customers. Traders should also look for clear explanations of how ownership and settlement work in the finished product. The second quarter of 2027 is the milestone to watch, with delivery still ahead.