Weekly Brief: Apple as collateral, priced 120 hours a week

Aave V4 opened an equity-collateral market on Base this morning. Seven Coinbase tokenized stocks can now be posted as collateral against USDC.

The market runs 24 hours a day. The collateral price does not. Chainlink's tokenized equity feeds publish from 20:00 ET Sunday to 20:00 ET Friday, which is 120 of the week's 168 hours. For the other 48, and on US market holidays, the feed publishes nothing and the last Friday value stands with a stale timestamp. Tonight that starts at 00:00 UTC. A 24/7 lending market is borrowing against a 24/5 price.

Yesterday, Bitget saw approximately $351.6M in unauthorized transfers out of its hot and warm wallets, and has not said how.

Everything below is current as of 25 September 2026, 17:10 UTC. Token supplies and Aave rates are read from Base and Ethereum; the rest is sourced at the end.

Aave V4 takes Apple

The Equities Hub went live on Base on Friday with seven tokens: AAPLc, AMZNc, GOOGLc, METAc, MSFTc, NVDAc and TSLAc. They are issued by Coinbase Onchain SPV Ltd., with the underlying shares held by Alpaca Securities LLC in segregated custody. Only eligible non-US users in permitted jurisdictions can touch them.

The structure is V4's hub and spoke. All seven stocks pool into one market against a single USDC reserve, with risk parameters set per asset so a problem in one equity does not reprice the others. USDC is the only borrowable asset. Aave capped USDC supply at $32M and USDC borrows at $21M. Each stock has its own collateral cap in tokens, which at today's prices add up to about $30.5M; LlamaRisk's figure at launch was roughly $29M. Collateral factors run from 65% on Meta and Tesla to 79% on Microsoft, and all seven share the same liquidation terms: a bonus of 4.95% at health factor 1.0, rising to a 5.50% maximum at 0.90.

We read each token's supply against its cap.

Current supply sits below the caps, unevenly. All seven tokens together have $17.86M outstanding, about 58% of the $30.5M in combined caps. Per asset it varies more: NVDAc's 19,100 tokens already fill 80% of its 24,000 cap, MSFTc is at 76%, TSLAc at 29%. Supply is not a hard limit either. Aave's ARFC notes the tokens are minted on demand by authorised participants and that supply is expected to follow collateral demand, so the question is whether issuance and on-chain liquidity grow into the risk limits, not whether the limits can be reached.

Then there is the weekend. The feeds cover pre-market, regular, post-market and an overnight session, and stop at 20:00 ET on Friday. From then until 20:00 ET Sunday, borrowers can open and close positions, repay, and be liquidated, all against a collateral value frozen at Friday's last print. Anything that happens to Apple over a weekend, an earnings leak, a product recall, a regulatory filing, does not reach the market until it reopens.

That is a different risk from the ones this brief has spent a month on. Moonwell and Tectonic were killed by collateral whose price moved too easily. Here the price cannot move at all for a fifth of the week, and the exposure is the gap that opens when it starts again. A borrower near the top of the permitted range against MSFTc can stay apparently healthy all weekend while the oracle holds, then become liquidatable on the first new price Sunday night.

Aave has sized the market so that, for now, the number at risk is small. The reason to watch it is that this is the template. NYSE and Blockchain.com are exploring 24/7 tokenized trading of US stocks and ETFs, which would close the pricing gap, and Aave has said GHO and further Coinbase tokens could follow subject to governance. The weekend hole is a property of today's market data, not of the design.

Bitget: $351.6M out of the hot wallets

At 18:31 UTC on 24 September, Bitget's monitoring flagged unauthorized transfers. Its own security notice puts the funds affected at approximately $351.6M, from part of the hot and warm layers of a three-tier wallet setup. Reporting puts the transfers inside twenty minutes; if the figure holds it is the largest exchange incident of 2026.

The method has not been disclosed. Bitget says it "will not speculate on the attack vector until the investigation is complete" and has given no date for a report. CEO Gracy Chen said the firm "will not run from this."

What Bitget has confirmed: cold wallets are unaffected, the User Protection Fund holds over $464M, deposits and trading are running, and withdrawals are paused until the security review finishes.

This is the second nine-figure loss in three weeks. Liquid was $319M on 6 September through a bug in shared node software; Bitget is $351.6M through something it has not named. The common factor is neither a lending market nor an oracle. Both were custody: who holds the keys, and what happens when the process that moves funds does something it should not. A reserve fund is the part of the answer Bitget had ready.

Follow-ups

cirBTC tripled again. We have tracked Circle's wrapped bitcoin since it sat flat at 40.02 BTC for five weeks. It was 198.59 on 16 September. It is 632.96 cirBTC today, worth about $53.1M at $83,851. Two step changes in nine days, from 40 to 633, on a token that did nothing for the whole of August. The custody pitch is getting bought.

Arc doubled. Circle's chain was at $333.7M of TVL on day one. It reads $472.2M today. Aave V4's Arc market went from $77.4M to $182.2M, and Aave V4 across all chains is now $638M against $474M nine days ago.

Liquid's 598.5 BTC has not moved. The address holding the unreturned portion of the September peg-out reads 598.50439510 BTC, unchanged since the 3,400 went back on 7 September.

Rates caught up with the Fed, partly. Aave V3 on Ethereum pays 3.69% on USDC and 3.67% on USDT this afternoon, against 3.60% and 3.15% before the hike. Fed funds is 3.75-4.00%. The gap on USDC narrowed from 28 basis points to 19; USDT closed most of it.

What we are watching

• Sunday night on the Equities Hub. The first weekend gap is this one. Whether positions get liquidated on the first new price at 00:00 UTC Monday is the thing to look for.
• How Bitget was breached, and when withdrawals reopen. Bitget has named no timeline for either.
• NVDAc against its cap. At 80% of the 24,000-token limit it is the one asset where the cap could bind soon, if new minting follows demand.
• cirBTC at 633. Two jumps in nine days is not a trend yet. The October number decides whether Liquid's failure permanently repriced who institutions want holding their bitcoin.

Sources: Token supplies read by us with totalSupply() against the seven Coinbase stock token contracts on Base; prices and pool liquidity from DexScreener; Aave V3 Ethereum rates from the pool contract; cirBTC supply from 0x72DFB2E4... on Ethereum; the Liquid address balance from the Blockstream API; Arc and Aave V4 chain TVL from the DefiLlama API. Caps, collateral factors, liquidation terms, the feed schedule and the minting note from Aave's deployment ARFC; the issuer and structure from The Block, Cryptobriefing and The Crypto Times. Bitget's figures and status from its security notice, timing and the CEO's statement from Startup Fortune and Spazio Crypto. BTC price from CoinGecko.