GameFi Weekly News Review — September 28–October 4, 2026
Across the nine chains we track, 1,053,000 people played on-chain games each day in the week of September 28–October 4, 2026 — a third straight weekly gain, up 0.3% from the week before. Below, every dated item is a real event from that window, linked to a mainstream outlet, the official announcement behind it, or the primary data source it is measured from. Where I add my own estimate, I say so.
The week in three numbers:
| Figure | What it says |
|---|---|
| $387.5M | Bitget's revised breach loss, after the last withdrawal rail reopened October 2 |
| $50.39M | Net assets the TRXS ETF disclosed as of September 28, with 89.85% staked |
| 13.26M | SUI tokens released October 1, about 0.32% of circulating supply (≈ $15.5M) |
Chains and network activity
The window's chain-level items: Ronin's Karst upgrade, scheduled for October 7 as the network's first since its move to an Ethereum layer 2, and a TRON week that ran from a mandatory node upgrade to an ETF crossing fifty million dollars.
Ronin schedules the Karst upgrade for October 7
Ronin published the terms of its next network upgrade on September 28 and flagged it on X the next day: Karst goes live on mainnet October 7 at 16:00:01 UTC, bringing Ethereum's Fusaka execution-layer improvements, a new L2 Contract Manager that can upgrade Ronin's core contracts in a single block, and an L1-contract update to op-contracts v7.0.0. Node operators must move to op-reth v2.2.3 before activation — nodes that do not upgrade will stop following the chain, and op-geth support ends with Karst. For players the change is designed to be invisible: no action, no downtime, and a new gas cap of roughly 16.8 million per transaction sits far above ordinary game moves — a typical DEX swap runs near 10,000 gas, per the announcement. It is the network's first upgrade since the May 12 hard fork that moved Ronin from an independent sidechain to an Ethereum layer 2 on the OP Stack — the migration that cut RON inflation from more than 20% a year to under 1% and redirected 90 million RON from staking rewards to the treasury.
Ronin is the largest economy in our table — 306,100 daily players — so its upgrade cadence matters to more players than any other chain's. The terms are public and none of them touch the fee line: Karst re-prices cryptographic precompiles (P256VERIFY roughly doubles) and caps transactions near 16.8 million gas, both far from the $0.0000 entry a Ronin game transaction carries. The May fork changed tokenomics, not fees; Karst changes client plumbing, not fees. I will re-price if anything lands in the fee column after October 7.
TRON's institutional week: TRXS crosses $50M and a mandatory node upgrade ships
TRON's week ran on three rails. TRON DAO and founder Justin Sun rang the closing bell at Cboe in Chicago on September 29 to mark the Canary Staked TRX ETF's first weeks of trading; the fund's own disclosure page put net assets at $50.39 million as of September 28 — roughly 151 million TRX — with 89.85% of assets staked and Luganodes named as the staking provider. TRON DAO announced a mandatory core upgrade on September 30, GreatVoyage-v4.8.2.3, requiring node operators to upgrade. And TRON Inc. disclosed a purchase of 148,413 TRX at an average $0.3369 on September 30, lifting its holdings to about 716.7 million TRX.
Three numbers, one direction: 89.85% of a listed fund's TRX locked in staking, a node fleet moved onto a mandatory upgrade cadence, and a treasury buying more. None of it moves the energy price — 100 sun is chain policy, not market sentiment — but all of it deepens the staked-TRX base that the rental market ultimately prices against. I gave the fund's books the full arithmetic in this week's deep dive.
Games and launches
One item from the business side of the games table: a global Android launch with a built-in token sink.
WEMIX PLAY launches Hellsquad Rrrush: Stone Rush globally on Android
WEMADE's WEMIX PLAY platform launched Hellsquad Rrrush: Stone Rush globally on September 29 — a casual roguelike defense game from LightCON, available on Android, with the official releases noting Web3 access is restricted in South Korea, China, Singapore and OFAC-sanctioned territories. The web2 original reached #1 on Google Play's games chart within three days of its July 2025 release and passed one million downloads. The web3 version adds a two-tier token loop: territory-control play mines HELLSHARD, which converts into HELLSTONE and on into WEMIX under daily conversion limits, with three separate webshops denominated in PLAY, AMBER and WEMIX tokens.
The design to note is the sink: every reward token has to pass through capped conversion rails before it becomes spendable WEMIX, a deliberate brake on reward-token supply — the same arithmetic that decides whether a play-and-earn payout holds its value. Chain fees do not enter it, because WEMIX 3.0 is not in our nine-chain set. But the pattern — an economy designed as a sink first — is the healthiest signal in this week's launch news.
Tokens, NFTs and in-game economy
The token side of the window was supply again: three scheduled releases, led by SUI's 13.26 million tokens.
The week's unlocks: SUI's 13.26M release leads a quiet calendar
Three scheduled releases crossed the window. Sui unlocked 13.26 million SUI on October 1 — about 0.32% of circulating supply, roughly $15.5 million at the day's price — a routine monthly tranche earmarked for early contributors, the community reserve and Mysten Labs. Ethena released about 40.63 million ENA on October 2, roughly 0.45% of circulating supply and about $11 million, and Wormhole's 50.41 million W — about 0.50% of its total supply, per CoinGecko's tracker — landed the same day. Some unlock calendars carry a larger 64.2 million figure for Sui; CoinMarketCap, Gate Research, Yahoo Finance and Tokenomist all count 13.26 million, and I go with the multiply-sourced set. None of the three is a top-ten game economy token, and the heavier supply events sit just outside the window — Ethena's final investor unlock, roughly 1.41 billion ENA or about 14% of circulating supply, is scheduled for October 5.
Three unlocks in two days is not a dilution wall, and none of the three touches our table directly. The lesson still holds for the tokens players are paid in: unlock weeks tend to soften the reward token before they soften anything else, which raises the real cost of a play-and-earn session even when the gas number never moves. The chain fee is the same on Sunday as it was on Monday; the payout behind it is not.
Security, policy and infrastructure
The security story of the month reached its ending: Bitget finished reopening every withdrawal rail it froze on September 24, while the month's loss tally and two infrastructure scares rounded out the ledger.
Bitget finishes reopening withdrawals as the loss tally settles at $387.5M
Bitget completed the phased reopening it began after the September 24 breach. Bitcoin withdrawals resumed September 28, Ether and EVM-chain assets on September 29, USDT on Ethereum, BNB Chain, Solana and TRON on September 30, and the remaining assets, fiat channels and P2P on October 2. The company revised the loss to $387.5 million after adding the Zcash and TRON legs to the initial $351.6 million estimate, and disclosed on September 30 that the entry point was a zero-day vulnerability in a third-party security product. Outflows ran hard anyway: Bloomberg, citing DefiLlama proof-of-reserves data, reported roughly $463 million of net customer outflows in the 24 hours into September 29 — the largest single-day net outflow in DefiLlama's four-year series.
Four of our nine chains sat on that freeze list, and the $463 million single-day outflow is the cost number this site prices: custody concentration is a fee that only appears on the day you cannot withdraw. The defense is the same reconciliation discipline recommended when the breach hit — independent matching of every outgoing transaction against your own ledger. None of it changes the fee table; all of it changes the risk line underneath.
MetaMask discloses an infrastructure security incident
MetaMask disclosed on September 30 an ongoing security incident affecting some of its infrastructure, and updated on October 1 that it had exited the affected validator nodes, with no direct threat to wallets or funds identified so far. The company said the investigation continues and that users' seed phrases were not implicated by what has been found to date.
Even non-custodial products run on hosted infrastructure — RPC endpoints, validators, relayers — and this incident is a reminder that the hosted layer is part of the risk surface a game studio inherits when it embeds a wallet. The practical step is dependency mapping: know which third-party nodes your game's transactions traverse, because that is where a compromise would surface, not in the fee table.
GoPlus counts 39 September incidents and about $793M in losses
GoPlus Security's monthly tally, reported October 1, counted 39 web3 security incidents in September with roughly $793 million in losses — a figure dominated by the Bitget breach on September 24. The tally covers exchanges, bridges, DeFi protocols and consumer wallets; the median incident in it is orders of magnitude smaller than the headline number.
The skew is the lesson for anyone budgeting security: September's loss total is one incident wearing a month's clothing. A studio that sized its custody risk on the median exploit would have been off by two orders of magnitude this month. Price the tail, reconcile daily, and treat venue balances as a short-term position rather than a storage decision.
Microsoft's X account hijacked to promote a scam token
BleepingComputer reported on October 2 that attackers hijacked Microsoft's official account on X — an account with more than 13 million followers — and used it to post promotions for a crypto token in an apparent pump-and-dump scheme. The incident is the highest-profile account takeover of the window and follows the same pattern as previous verified-account token scams.
Game players are the exact audience these posts target, because they already click token links for a living. The defense is unglamorous: treat any token announcement — from any account size, verified or not — as unverified until it is checked at the project's own domain. The cost of one malicious approval is not measured in gas; it is measured in the whole wallet.
The week's cost context
Every chain-level number below comes from the same week's measurement; the nine-chain table, persona monthly costs and the TRON route comparison are broken out in full in the cost update.
| Chain | Cost per game tx | GameFi DAU | DAU WoW |
|---|---|---|---|
| Ronin | $0.0000 | 306,100 | +0.4% |
| Immutable | $0.0000 | 142,300 | +0.6% |
| Solana | $0.00023 | 208,200 | −0.7% |
| Polygon | $0.0204 | 68,100 | −1.2% |
| Base | $0.0406 | 41,500 | +1.7% |
| Arbitrum | $0.0792 | 44,300 | +0.9% |
| BNB Chain | $0.0936 | 100,900 | +0.5% |
| TRON | $0.7388 | 116,400 | +1.6% |
| Ethereum | $2.9150 | 25,200 | −1.9% |
FAQ
Was the Bitget loss really $387.5 million?
That is the revised figure Bitget published after adding the Zcash and TRON legs to the initial $351.6 million estimate, carried by BleepingComputer and other outlets alongside the September 30 disclosure that the entry point was a zero-day in a third-party security product. Withdrawals finished reopening on October 2. What is not disputed is the phased schedule — Bitcoin first on September 28, USDT on TRON on September 30 — or that customer ledger balances stayed intact.
Did the Bitget disruption change TRON transfer costs?
No. The freeze was venue-side: Bitget paused its own withdrawal processing while the security review ran. TRON chain fees — 100 sun per energy unit, the 34 SUN rental median — never moved, and TRON's GameFi economy grew 1.6% in the same week, its fourth straight weekly gain.
What does the Ronin upgrade change for players?
Less than the headline suggests. The terms are published: Karst activates October 7 at 16:00:01 UTC, players need no action and there is no downtime, and the new ~16.8M gas cap sits far above a typical game transaction. The work falls on node operators and builders — move to op-reth v2.2.3 before activation, or the node stops following the chain. Ronin remains a $0.0000 fee line in our table.
Is the SUI unlock bad for Sui games?
Not mechanically. Sui is not one of the nine chains we price — its gas market sets its own transaction cost and does not price in unlock supply. What an unlock moves is reward economics: treasuries and player payouts denominated in SUI quote against a larger float after October 1.
What is TRXS, and does it change what a game transaction costs?
TRXS is the Canary Staked TRX ETF listed on Cboe BZX — a wrapper that holds TRX and stakes about 90% of it, with rewards accruing to the fund's net asset value. It does not change game transaction costs: the energy price (100 sun), the rental median (34 SUN) and the burn fallback ($2.1728) are all untouched. The full arithmetic is in the deep dive.
Which of the week's security events touched GameFi directly?
None hit a major game economy on the nine chains we track. The GoPlus tally's $793 million is dominated by the Bitget exchange breach; the MetaMask incident is wallet infrastructure; the Microsoft account hijack is a consumer scam. The standing lesson for studios is the same from all three: custody and approvals, not chain fees, are where the losses are.
Sources
- Ronin blog, September 28, 2026, and Ronin Network on X, September 29, 2026（Karst upgrade live October 7 at 16:00:01 UTC; Fusaka execution-layer improvements; L2 Contract Manager; op-contracts v7.0.0; op-reth v2.2.3 required and op-geth end of support; ~16.8M per-transaction gas cap; no user action and no downtime; first upgrade since the May 12 OP Stack migration）.
- TRON DAO and Justin Sun on X, September 29–30, 2026（Cboe closing bell for TRXS in Chicago on September 29; TRON Inc. purchase of 148,413 TRX at $0.3369 on September 30, holdings about 716.7M TRX）.
- Canary Staked TRX ETF fund page, data as of September 28, 2026（net assets $50,393,148.47; roughly 151M TRX; 89.85% of assets staked; Luganodes named as staking provider; premium 0.12%; 30-day average spread 0.24%）.
- TRON DAO official announcement, September 30, 2026（GreatVoyage-v4.8.2.3 mandatory node upgrade）.
- WEMADE official announcement, September 29, 2026（Hellsquad Rrrush: Stone Rush global Android launch; HELLSHARD converts into HELLSTONE, exchangeable for WEMIX under daily conversion limits; three token-denominated webshops; web2 original #1 on Google Play within three days, 1M+ downloads）.
- Unlock calendars — CoinMarketCap and Gate Research October previews, Yahoo Finance, Tokenomist and CoinGecko, September 28 – October 3, 2026（SUI 13.26M ≈ 0.32% of circulating supply ≈ $15.5M on Oct 1; ENA ~40.63M ≈ $11M on Oct 2 with the ~1.41B investor unlock scheduled Oct 5; W 50.41M on Oct 2）.
- Bitget official updates on X and BleepingComputer, September 28 – October 2, 2026（phased resumption: BTC Sep 28; ETH and EVM assets Sep 29; USDT on Ethereum, BNB Chain, Solana and TRON Sep 30; remaining assets, fiat and P2P Oct 2; revised loss $387.5M after Zcash and TRON legs; zero-day in a third-party security product disclosed September 30）.
- Bloomberg via DefiLlama proof-of-reserves data, reported September 29, 2026（roughly $463M net customer outflows in 24 hours — the largest single-day net outflow in DefiLlama's four-year series）.
- MetaMask on X and BleepingComputer, September 30 – October 1, 2026（infrastructure security incident; exited affected validator nodes; no direct wallet or fund threat identified so far）.
- GoPlus Security monthly tally via X, October 1, 2026（39 web3 security incidents in September, roughly $793M in losses）.
- BleepingComputer, October 2, 2026（Microsoft's X account with 13M+ followers hijacked to promote a token in an apparent pump-and-dump scheme）.
Not financial advice. This review reports on events and public data for informational purposes; nothing here is a recommendation to buy, sell or hold any asset.