bitget

Cross-chain trading protocol NEAR Intents stated in a post on X that on September 24, Bitget was attacked, resulting in approximately $387.5 million in funds being stolen, most of which were aggregated into Ethereum and converted to ETH. The hacker attempted to transfer over $50 million through NEAR Intents, but ultimately only $166,000 was successfully transferred, while $503,000 was intercepted during the execution process.NEAR Intents indicated that the relevant data comes from on-chain tracking tools, Arkham, internal logs, and risk control layer SHIELD, among other sources. The figures listed are rounded estimates, with an assessment deviation of no more than 10%. SHIELD identified over $50 million in money laundering attempts and has filtered out duplicate flows, of which $166,000 has been successfully transferred, while another $503,000 was frozen midway through execution and remains restricted, pending legal and recovery procedures.NEAR Intents stated: permissionless does not equal neutral, the team refuses to assist in cashing out stolen assets and will forgo the bounty from this incident to allow Bitget to recover funds as much as possible. Bitget previously established a 5% + 5% bounty arrangement. NEAR Intents also mentioned that the protocol will remain permissionless but set boundaries, and will combat money laundering of stolen funds, while suggesting Bitget contact legal and law enforcement channels to handle the frozen funds.

According to @ai_9684xtpa monitoring, the Bitget BTC protection fund currently has 5,500 BTC, with 3,215.28 BTC having flowed out, valued at approximately 266 million USD, and there are still 2,284.71 BTC remaining on-chain. The most recent transfer from the Bitget hot wallet was 13 hours ago.

According to the official announcement, Bitget has launched the "Peer Program," offering trading rewards, asset rewards, and exclusive rights to different user groups, in order to give back to users who have continued to show trust and support during recent security incidents.For non-institutional users, Bitget will establish a dedicated prize pool using 30% of the platform's trading fee revenue. 60% of the prize pool will be distributed based on user trading volume, while 40% will be distributed based on asset value, with rewards issued in the form of USDT.In addition, Bitget will provide eligible V1 to V7 users with a 30-day protection experience card before October 1, which can be activated and used in the coupon center. This event will take place from September 28 to October 26, divided into four cycles, each lasting 7 days. Specific activity rules are subject to the official Bitget page.

Bitget has officially opened BTC withdrawal services today at 16:00 (UTC+8). Bitget CEO Gracy shared the latest progress on the recovery during a community live stream: currently, the BTC withdrawal channel is running smoothly, and the first batch of applications has been processed and credited.According to real-time data disclosed during the live stream, as of 16:50 (UTC+8), the platform has processed approximately 7,683 BTC withdrawal applications, with a total amount processed of about 3,609 BTC, and there are no order backlogs. Among them, the first batch of about 6,946 withdrawal applications has received blockchain confirmation, and the related applications are still being processed in an orderly manner.According to the previously announced timeline, the ETH-related network will open for withdrawals on September 29 at 16:00 (UTC+8), and the USDT-related network will open for withdrawals on September 30 at 16:00 (UTC+8); withdrawals for other tokens, fiat, and C2C services will gradually resume starting from October 2 at 16:00 (UTC+8).

Bitget's Greater China Regional Head, Xie Jiayin, recently addressed community concerns during a live broadcast. He reflected that since Bitget's establishment 8 years ago, user asset security has always been the top priority, successfully resisting multiple attempts of cyber attacks and maintaining a long-term record of secure operations. This incident marks the first security crisis in the platform's 8-year development history.Upon complete tracing, this incident is classified as a special attack targeting a third-party security software supply chain. The attacker exploited vulnerabilities in third-party products to obtain internal network credentials; however, private keys were not leaked, and cold wallet assets were unaffected. Currently, Bitget has partnered with security agencies Mandiant and SlowMist to conduct an independent review and will comprehensively upgrade the monitoring and management standards for third-party components. We are not only committed to promoting a full recovery following this incident but will also contribute to a safer, more robust, and healthier development of the industry through continuous technological iteration and system upgrades.

Bitget has officially opened the phased withdrawal feature as scheduled, and BTC withdrawal services are now available. According to the previously announced timeline, ETH-related networks will open for withdrawals on September 29 at 16:00, and USDT-related networks will open for withdrawals on September 30 at 16:00.Withdrawals for other tokens, fiat currency, and C2C services will gradually resume starting from October 2 at 16:00. Currently, Bitget's CEO Gracy Chen and the head of the Greater China region, Xie Jiayin, are reviewing and explaining this security incident through a public live broadcast, updating on the latest developments, and answering user questions on-site.

In today's community live broadcast, Bitget CEO Gracy responded to recent security incidents and the platform's financial status. She candidly stated that this is the first security incident encountered since Bitget was established 8 years ago. After a complete trace, it was found that hackers exploited vulnerabilities in third-party security products to steal internal network access credentials, forged withdrawal commands to the wallet system, and deceived the wallet into executing abnormal transfers that bypassed risk checks. Gracy emphasized that no private keys were leaked, and cold wallets were unaffected; specific technical details will be disclosed in the formally released security report.Gracy pointed out that the verified losses from this incident are within the coverage of the protection fund, and user funds are not affected. The platform's own funds exceed $1.4 billion, which includes approximately $464 million in the user protection fund. The platform will continue to uphold the security commitments made when the protection fund was established in 2022, planning to replenish the fund to the baseline of $300 million within a week."The protection fund is not just a slogan, but an important mechanism that provides tangible security for users in the event of extreme security incidents," Gracy stated. In the face of sudden security challenges, the platform's comprehensive strength and its ability to take responsibility are important criteria for measuring its risk response capability and long-term credibility. Bitget will continue to uphold its long-term commitment to prioritize user interests.

MistTrack disclosed that following the $1.46 billion hacking incident at Bybit last year, where nearly $1.2 billion in stolen funds were transferred via THORChain, Bitget has recently experienced another significant security incident, with stolen funds suspected to have once again flowed through THORChain.In response, THORChain officials stated that their protocol, like Bitcoin, Ethereum, and BNB Chain, belongs to a decentralized and permissionless network.

Bitget CEO stated that the attacker's address has been publicly listed and is under continuous tracking. Bitget calls on THORChain to refuse service to these addresses. Decentralization is a design principle and should not serve as a shield to facilitate known stolen funds.

Bitget CEO Gracy Chen stated on the X platform that the Bitget bounty recovery program has been launched: a 5% reward for facilitating the freezing of the attackers' funds, and an additional 5% reward for successfully recovering the funds. She called on exchanges, security researchers, and on-chain investigators to participate in tracking and recovery, and thanked Circle and Tether for their swift freezing actions.According to previous reports, Circle and Tether have frozen 218,023 USDT and 99,990 USDC in addresses related to the Bitget attack, totaling approximately $318,000. Bitget stated that the attack resulted in losses of about $351.6 million, with the attackers breaching the wallet service backend system, forging transfer information, and triggering the authorization signature process, ruling out private key leakage.

According to Lookonchain monitoring, about 11 hours ago, a certain address withdrew 257.6 ETH from Binance, worth 692,000 USD, and 545,000 USDT, then exchanged 545,000 USDT for 200.2 ETH. About 1 hour ago, the address transferred all 457.9 ETH, worth 1,230,000 USD, into the Bitget hacker wallet.

Bitget stated that the vulnerabilities related to the security incident discovered on September 24 have been confirmed and fixed. The platform will gradually resume withdrawals after completing further security checks. Mandiant, a cybersecurity company under Google, and Slow Mist Technology are assisting in the investigation.The resumption schedule is as follows (UTC):September 28, 8:00: Bitcoin network BTCSeptember 29, 8:00: Ethereum, BNB Smart Chain, Arbitrum, Base, Optimism network ETHSeptember 30, 8:00: Ethereum, BNB Smart Chain, Solana, Tron network USDTOctober 2, 8:00: Other tokens, fiat currencies, and peer-to-peer transactionsBitget mentioned that the suspension of withdrawals is a temporary security measure and is unrelated to the availability of user assets; account balances have not been affected, and the protection fund will cover the financial impact caused by this platform-level incident. The situation is currently under control, and unauthorized transfers will not occur again. Trading and deposit services are still operating normally. Users do not need to take any action in advance; the specific reopening situation will be subject to notifications from the platform and official channels.

Zhao Changpeng posted that today is a difficult day for Bitget. He believes and knows that Binance, the BNB Chain ecosystem, and the community will do everything possible to provide assistance, and he calls on the community to stay "SAFU".

Bitget TradFi Chief Growth Officer Xie Jiayin issued an update on the platform's security incident, stating that the withdrawal time will be announced before noon tomorrow. The security team has identified the hacker's attack path and methods, and has grasped the details of how the attacker bypassed security measures, coming very close to tracing the source of the attack. The incident investigation by third-party security teams Mandiant and SlowMist is still ongoing, with a detailed report pending from the security team.On-chain tracking confirms that approximately $387.5 million has been transferred to the hacker's address, previously estimated at $351.6 million. This revision includes ZEC and TRX, and no other unauthorized transfers have been found. Xie Jiayin stated that the stolen funds at the platform level will be fully covered by the Bitget User Protection Fund, ensuring that user assets are not subject to any losses.Bitget has officially launched a fund recovery bounty program, offering a 5% bounty for voluntarily freezing the attacker’s funds and a 5% bounty for voluntarily recovering funds. The bounty also applies to assistance already provided. The platform has published the attacker's address, a real-time tracking dashboard, and a submission portal, with relevant information also available for submission through Bybit's Lazarus bounty platform.

Bitget stated that the withdrawal recovery plan will be announced before September 26 at 4:00 UTC (12:00 Beijing time) and thanked users for their patience.Bitget previously confirmed that approximately $387.5 million in assets were transferred to addresses controlled by attackers during this security incident, involving assets such as ETH, XRP, USDT, ZEC, USDC, USDT0, XAUt, BNB, AVAX, and TRX.Bitget claimed that the incident is currently under control, and no further unauthorized transfers have been detected. Withdrawals are temporarily suspended, and investigations and asset tracking are still ongoing.

According to on-chain data, Tether has successfully frozen 218,000 USDT in the stolen address from Bitget, which is a "three-hop" associated address of the initial stolen address from Bitget. This address remained inactive for over 2.5 hours after being discovered.Crypto KOL tanuki42 initiated a tracking of "Circle vs Tether" at that time and asked which of the two companies would freeze the related assets first.Currently, Circle has frozen the related stolen assets 7 hours and 18 minutes earlier than Tether.

According to on-chain analyst tanuki42, the address 0xe07 holds 100,000 USDC and 218,000 USDT, which come from the initial address of stolen funds from Bitget. This batch of funds has been idle for over 2.5 hours, after which they publicly called on Circle and Tether to freeze the assets.At 5 PM, crypto researcher SomaXBT posted that Circle has frozen the USDC assets and specifically called on Tether to follow up. As of the time of publication, Tether has not responded.

ViaBTC founder and CEO Yang Haibo stated: CoinEx is shutting down, but its hot wallet system is still relatively advanced and worth referencing in the industry. He introduced that CoinEx has implemented an MPC-based dual-signature scheme for its hot wallet to eliminate single points of failure.Yang Haibo mentioned that the relevant infrastructure is split into business systems and wallet systems, operated by completely independent teams, each holding one private key. Every withdrawal or transfer must be reviewed in real-time through substantial risk control by both parties, and even if one system is compromised, assets cannot be stolen.He added that the wallet signing process needs to be independently implemented and cannot rely on the native mechanisms of each node, which requires extensive reconstruction. The team spent over a year transforming the vast majority of nearly 300 chains supported by CoinEx one by one.

Binance Co-CEO Richard Teng stated that since the discovery of the security incident at Bitget, the Binance security team has been closely collaborating with Bitget to assist in sharing security intelligence, tracking related funds, and supporting asset recovery efforts.Richard Teng mentioned that in such security incidents, the cryptocurrency industry will unite to respond to attackers, and the relevant assistance work is still ongoing.