Citi's $113K Call & Q3 Hacks

Bitcoin traded at $86,627 on October 2, 2026, 31% below its all-time high of $126,156 and 6.05% above its 20-day average. The price sits 0.76% below the September 21 high of $87,291, the top of the range since July. Beneath the price, Citigroup raised its 12-month Bitcoin target on the back of returning ETF money, while CertiK's quarterly count shows September was the costliest month for crypto hacks in 2026.

Citi Raises Bitcoin Target to $113,000: ETF Flows Drive the Call

Citigroup's revised forecast leans on the same buyer that carried the third quarter: the spot ETF.

• The new numbers: Citi raised its 12-month Bitcoin forecast to $113,000 from $82,000, and its ether forecast to $3,028 from $2,240, per CoinDesk. At the time of the note, the targets implied gains of about 35% for BTC and 12% for ETH.

• What Citi cited: The bank pointed to resumed ETF inflows and supportive economic conditions, including the US Treasury's buyback of longer-dated bonds, which it said helped crypto break out of a months-long slump against other risk assets.

• A slower pace built in: Citi forecasts $5 billion of inflows into crypto investment products over the next 12 months and describes the expected flows as "slower but stickier," as advisers and brokerages add Bitcoin gradually.

• The quarter behind the call: US spot Bitcoin ETFs recorded about $6.34 billion in net inflows in the third quarter, their strongest quarter of 2026, according to SoSoValue data reported by Cointelegraph.

• Two readings of the quarter's gain: CoinGlass data cited by Cointelegraph puts Bitcoin's Q3 gain at 42.71%, its best third quarter since 2017, while CoinDesk reported a 40% rise. Neither figure states the same open and close points, so the range is the honest reading.

• The streak ended, then flows resumed: Spot Bitcoin ETFs lost a net $148.7 million on September 30, ending a nine-day, $3.1 billion inflow run, per The Block. Fidelity's FBTC led with $125.6 million in outflows.

• The policy caveat in the note: Citi said agency rulemaking may substitute for the failed Clarity Act for now, while flagging the risk that a change of administration in 2028 could roll those rules back, a risk it places outside its forecast window.

• Sentiment runs warm: Alternative.me's Fear & Greed Index reads 72, in its "Greed" band. Bitcoin has gained 14.6% since the Fear & Greed Index last hit 69 on September 15, tracking closest to the November 2023 and August 2021 readings in Coinjuice's study of every Fear & Greed reading of 69, both of which kept climbing over the following three months.

Interpretation: Citi's old $82,000 target now sits below spot, and the new one assumes ETF inflows slow from the Q3 pace to roughly $5 billion over a full year. The upgrade rests on steady, adviser-led buying rather than another sprint. It is a forecast, not a guarantee. The September jobs report, scheduled by the BLS for 8:30 a.m. ET on October 2, is the next macro checkpoint for that buying.

Crypto Hacks Cost $1.26 Billion in Q3: Two Breaches Drove Most of It

The same quarter that brought billions into regulated funds also produced the year's heaviest month of thefts, and two breaches account for most of the damage:

• The quarterly bill: Crypto suffered 247 security incidents in the third quarter, with losses of $1.26 billion, according to CertiK data cited by CoinDesk. Losses for 2026 so far stand at $2.68 billion.

• Two breaches drove most of it: The $387.5 million theft from exchange Bitget on September 24 and the $318.7 million exploit of Blockstream's Liquid Network on September 6 made up more than 92% of September's confirmed losses, per CertiK's breakdown reported by Crypto Times. Together they account for roughly 56% of the quarter's $1.26 billion. Bitget reported a lower loss of $351.6 million in an earlier statement.

• Gross versus net: September logged 99 incidents, the most since February 2025, and $768.5 million in gross losses, the largest monthly total of 2026, per CoinDesk. CertiK classed about $270.6 million as returned or frozen, leaving roughly $495.8 million unrecovered. Most of the recovery came from the Liquid exploit. CertiK's September 30 recap gives a slightly lower gross total of $766.4 million.

• A smaller case on Aave: An attacker forged Safe authentication to exploit a FlashLoopAdapter module for Aave v3, draining two multisigs of an estimated $305K to $310K, per Crypto Briefing, which dates the drain to October 1. Security firm SlowMist flagged the attack on October 2 and put the loss at about 114.09 ETH.

• What failed, and what did not: Neither Aave v3 nor Safe's core infrastructure was compromised. The weak link was the FlashLoopAdapter, a module the victims had enabled on their own wallets. A multisig's signature requirements offer little protection once a module has been granted a route around them.

• Other layers under pressure: MetaMask pulled its Ethereum staking systems out of service after a security incident, with a researcher reporting that block-production payments were diverted to another wallet, according to CoinDesk, which reported no funds at risk. CoinDesk also reported a $3.8 million exploit at NEAR Intents on October 1.

• Where institutional money sits: Nansen senior research analyst Nicolai Sondergaard told CoinDesk the losses barely register against ETF inflows, since most institutions buy through regulated wrappers and stay away from DeFi protocols. His summary of the reputational cost: "Yes, it is bad optics."

• A thin safety net: CoinGecko's State of Crypto Security Report 2026, published in late August before most of September's losses, put on-chain crypto insurance capacity at $130.2 million, down 20.2% from $163.2 million a year earlier.

Interpretation: The quarter's largest losses came from three different layers:

• An exchange: Bitget, a custodial trading platform.

• A sidechain: Liquid Network, where a flaw in its proof-checking code let an attacker create unbacked tokens and redeem them for real Bitcoin.

• A wallet module: an optional third-party add-on sitting on top of Aave.

None of the failures sat in Bitcoin's base layer or the Aave v3 core. ETF buyers hold through a regulated custodian rather than an exchange account, a sidechain or a DeFi position. That separation is why the strongest ETF quarter of 2026 and the year's costliest hack month could arrive together. Money enters through regulated funds while hackers target the infrastructure built around crypto.

Coinjuice Lens: Market Structure

In Q3 2026, money and losses took two separate routes. Investors put a net $6.34 billion into Bitcoin ETFs, according to SoSoValue. Meanwhile, hackers took $1.26 billion, per CertiK, mostly from the services people use to hold and move crypto rather than from Bitcoin itself. 

For holders operating outside the ETF wrapper, the practical question is how many of those layers sit between their coins and a thief. Coinjuice's five-point framework for auditing crypto infrastructure includes checking whether a protocol's audits are still valid and how its infrastructure has held up under stress. That makes it a useful filter before trusting any platform, bridge or module. Money enters through regulated funds while hackers target the infrastructure built around crypto.

Readers looking to weigh a bullish bank forecast against fragile infrastructure can start with the Coinjuice ebook, Bitcoin Trading Without Leverage, or go deeper with a Coinjuice subscription, where we start and complete trades and you will learn to snipe them independently.

News Behind Today's Read

• Citigroup Raises 12-Month Bitcoin Target to $113,000 as ETF Inflows Resume (CoinDesk). Source for Citi's revised BTC and ETH targets, the $5 billion inflow forecast, the Treasury buyback reference and the 2028 rollback caveat.

• Bitcoin ETFs' 9-Day, $3 Billion Inflow Streak Comes to an End as $149 Million Exits the Funds (The Block). Source for the September 30 outflow, the end of the $3.1 billion streak and FBTC's outflow.

• Bitcoin ETFs Draw $6.3B in Q3 as BTC Price Rises Nearly 43% (Cointelegraph). Source for the $6.34 billion Q3 ETF total from SoSoValue and the 42.71% quarterly gain from CoinGlass.

• Crypto Lost $1.26 Billion in Hacks While Bitcoin Bulls Enjoyed a Monster Quarter (CoinDesk). Source for CertiK's Q3 and September loss figures, the Nansen comments, the 40% quarterly gain and the insurance capacity data.

• Aave v3 Exploit Drains Up to $310K After Safe Module Attack (Crypto Briefing). Source for the FlashLoopAdapter exploit, the loss estimate and the confirmation that Aave v3 and Safe's core systems were not compromised.

Continue the read: Oct. 1 · Sept. 30 · Sept. 29

Market Snapshot

Data as of October 2, 2026, approximately 05:02 UTC. Source: DefiLlama. The Q3 ETF total from SoSoValue, the September 30 ETF flows,, Q3 price gains, Citi's forecasts, CertiK hack figures, exploit details and the Fear & Greed reading (Alternative.me) are externally reported and labeled by source above.

This article was developed with the support of artificial intelligence tools as part of Coinjuice's editorial process and reviewed by our editorial team before publication.

Disclaimer

The information provided in this article is for informational purposes only. It is not intended to be, nor should it be construed as, financial advice. We do not make any warranties regarding the completeness, reliability, or accuracy of this information. All investments involve risk, and past performance does not guarantee future results. We recommend consulting a financial advisor before making any investment decisions.