recover

According to The Block, the UK's Financial Conduct Authority (FCA) has obtained a court order requiring two individuals involved in a fraudulent cryptocurrency investment scheme to jointly repay £851,402, with plans to return the funds to the victims.At least 65 investors have collectively lost £1.54 million, and the amount being recovered is approximately half of that.

JPMorgan analysts stated that the recent pullback in global AI trading has improved investors' positions, making valuations more attractive, which may drive investors to reposition, especially in the semiconductor stock sector. JPMorgan pointed out that sustained strong earnings performance and evidence of AI commercialization will support investors' renewed focus on this sector.

The government of Kazakhstan is promoting the use of associated gas to power cryptocurrency mining, in order to restore the mining industry affected by power restrictions. President Kassym-Jomart Tokayev signed a decree in July requiring the establishment of mechanisms for enterprises to conduct digital mining using associated gas.Daniyar Mubarakov, head of the Blockchain and Digital Mining Association, stated that the total amount of associated gas in Kazakhstan can be converted into 1.2 to 1.3 terawatt-hours of electricity, sufficient to support medium or large data centers or Bitcoin mines in some oil fields. The Ministry of Energy of Kazakhstan estimates that there are up to 60 oil fields in the country producing associated gas. Oil companies can sell waste gas to miners, reducing disposal costs by millions of dollars, while miners can lock in electricity prices for years, reducing dependence on grid power.The government of Kazakhstan is developing a relevant legal framework to clarify the operational rules for enterprises and regulate the market. Gizzat Baitursynov, Deputy Minister of AI and Digital Development of Kazakhstan, stated that this mechanism will increase government tax revenue and improve the environment.

Cryptocurrency trader Ansem stated that he is quite optimistic about the real recovery of NFTs in this cycle, and art-related NFTs may see a price increase again.Ansem mentioned that what is more noteworthy is the innovation surrounding the forms of NFTs, including AI agents, ownership mechanisms, new issuance methods, and different models of NFTs combined with on-chain products. He believes that as the broader rotation of on-chain assets is still in its early stages, there may be more new applications and design explorations in the NFT field in the future.

Bitget CEO Gracy Chen stated on the X platform that the Bitget bounty recovery program has been launched: a 5% reward for facilitating the freezing of the attackers' funds, and an additional 5% reward for successfully recovering the funds. She called on exchanges, security researchers, and on-chain investigators to participate in tracking and recovery, and thanked Circle and Tether for their swift freezing actions.According to previous reports, Circle and Tether have frozen 218,023 USDT and 99,990 USDC in addresses related to the Bitget attack, totaling approximately $318,000. Bitget stated that the attack resulted in losses of about $351.6 million, with the attackers breaching the wallet service backend system, forging transfer information, and triggering the authorization signature process, ruling out private key leakage.

Cosmos Labs disclosed that on September 22, Neutron encountered a governance attack that led to the theft of liquidity from protocols such as Astroport, with approximately 1.73 million ATOM subsequently transferred by the attacker to Cosmos Hub. The Cosmos Hub itself was not attacked, and user funds were not affected. To prevent the stolen ATOM from being transferred out, Hub validators temporarily paused the network for about 24.5 hours and resumed block production on September 23 based on the patched Gaia v28.3.0.Cosmos Labs stated that during the pause, 1.227 million ATOM remained in the attacker's Hub address. When the network was restored, these were transferred to a 4/6 multi-signature address composed of Nansen, Keplr, Enigma, Silknodes, Kiln, and Polkachu through a one-time change. Previously, about 500,000 ATOM had been exchanged for ETH via THORChain and could not be recovered; another 169,000 ATOM entered the attacker's address after the network was restored due to THORChain refunds and were sold after being transferred to Osmosis. The current multi-signature address holds approximately 1.227 million ATOM, which can only be returned after authorization from a Cosmos Hub governance proposal. The related funds will not be staked, lent, or traded. The Neutron team expects to submit a recovery plan and related governance proposals next week.

Bitget TradFi Chief Growth Officer Xie Jiayin issued an update on the platform's security incident, stating that the withdrawal time will be announced before noon tomorrow. The security team has identified the hacker's attack path and methods, and has grasped the details of how the attacker bypassed security measures, coming very close to tracing the source of the attack. The incident investigation by third-party security teams Mandiant and SlowMist is still ongoing, with a detailed report pending from the security team.On-chain tracking confirms that approximately $387.5 million has been transferred to the hacker's address, previously estimated at $351.6 million. This revision includes ZEC and TRX, and no other unauthorized transfers have been found. Xie Jiayin stated that the stolen funds at the platform level will be fully covered by the Bitget User Protection Fund, ensuring that user assets are not subject to any losses.Bitget has officially launched a fund recovery bounty program, offering a 5% bounty for voluntarily freezing the attacker’s funds and a 5% bounty for voluntarily recovering funds. The bounty also applies to assistance already provided. The platform has published the attacker's address, a real-time tracking dashboard, and a submission portal, with relevant information also available for submission through Bybit's Lazarus bounty platform.

Bitget stated that the withdrawal recovery plan will be announced before September 26 at 4:00 UTC (12:00 Beijing time) and thanked users for their patience.Bitget previously confirmed that approximately $387.5 million in assets were transferred to addresses controlled by attackers during this security incident, involving assets such as ETH, XRP, USDT, ZEC, USDC, USDT0, XAUt, BNB, AVAX, and TRX.Bitget claimed that the incident is currently under control, and no further unauthorized transfers have been detected. Withdrawals are temporarily suspended, and investigations and asset tracking are still ongoing.

Binance Co-CEO Richard Teng stated that since the discovery of the security incident at Bitget, the Binance security team has been closely collaborating with Bitget to assist in sharing security intelligence, tracking related funds, and supporting asset recovery efforts.Richard Teng mentioned that in such security incidents, the cryptocurrency industry will unite to respond to attackers, and the relevant assistance work is still ongoing.

Bitget CEO Gracy Chen stated during a live broadcast regarding the platform's attack incident that some of the affected funds may have a chance of being recovered. Regarding the resumption of withdrawals, Gracy Chen mentioned that Bitget needs to first investigate the relevant issues thoroughly. The technical team is currently advancing system repairs and security enhancements. The platform will only reopen the withdrawal function after confirming the system's security and ensuring that resuming withdrawals will not lead to further attacks by hackers.She stated that once a clear time window for the resumption of withdrawals is established, users will be informed immediately and an announcement will be made. Currently, no specific time can be promised, as the platform does not wish to make commitments that cannot be fulfilled.

According to Bitcoin News monitoring, this batch of Bitcoin is worth over 4 million dollars, accounting for about 2.8% of the total Bitcoin related to the Coldcard vulnerability. Crypto Recovery Trust will verify the ownership of the funds and attempt to return them.Alex Thorn, head of research at Galaxy Digital, stated that another 3.0134 BTC was transferred to that address in the same transaction, but its source has not yet been confirmed.

The Cosmos ecosystem protocol Neutron faced a governance proposal that was manipulated by an attacker. The related address spent approximately 20,199 USDC to buy NTRN and staked 31.6 million NTRN about 12 minutes before the voting ended, ultimately allowing the proposal to pass with an 82% approval rate. Subsequently, the management rights of 11 contracts were transferred to the attacker, and they migrated to malicious code, stealing approximately 4.4 million dollars in assets.To recover the funds, Cosmos Hub validators coordinated a chain halt for nearly 24 hours and 48 minutes, and during the restart process, approximately 1.23 million ATOM were transferred from the attacker's wallet to a new address, with plans to return them to the original holders.

The President of the United States, Donald Trump, stated that he is working to restore smooth oil transportation in the Strait of Hormuz.

White hat actors transferred 40.71 bitcoins related to the Coldcard vulnerability into a single transaction, valued at approximately 3.31 million dollars. This transaction aggregated funds from 11 addresses and included OP_RETURN information pointing to the Crypto Recovery Trust.Alex Thorn, head of Galaxy Research, revealed that a larger aggregation transferred a total of 52.37 bitcoins, involving multiple clusters of attacker addresses, accounting for about 2.8% of the funds involved in the vulnerability. A firmware flaw in Coldcard devices from March 2021 led to insufficient randomness in the mnemonic phrases, with the peak amount of funds involved being approximately 130 million dollars.

The U.S. government oversight agency released a report acknowledging a shortage in the inventory of advanced weapons for the U.S. military, and disclosed the damage to military aircraft, military bases, and diplomatic facilities in the Middle East.The report pointed out that the war has led to a "strategic inventory shortage," exposing bottlenecks in the military-industrial capacity for ammunition replenishment. Experts estimate that it may take the U.S. military about three years to restore inventory to pre-war levels.

According to Cointelegraph, the cross-chain liquidity protocol Symbiosis announced that it has recovered 15 BTC (approximately $1.1 million) from its Bitcoin bridge vulnerability and deposited it into a multi-signature wallet controlled by the team. The vulnerability occurred last Friday, where the attacker exploited the protocol's flaw to mint 46.1 billion uncollateralized tokens, resulting in a profit of 4.3 WBTC (approximately $336,000).Symbiosis had previously offered a 20% white hat bounty to the attacker for the return of the assets, but the deadline has passed, and the attacker has not responded. The protocol is now offering a 20% bounty to anyone who can provide clues to help recover the assets, while also promising to announce a compensation plan for affected liquidity providers. The affected Bitcoin bridging function remains suspended.

The cross-chain protocol Chainflip disclosed that an attack incident targeting Tron USDT occurred yesterday. It has been confirmed that 736,442.17 USDT was stolen through 6 unauthorized payments, and an additional 115,654.41 USDT from user exchanges remains in the vault due to payment failures, while other funds were unaffected.Chainflip stated that the attacker exploited a vulnerability in the Tron transaction memo mechanism, attaching a custom memo to transactions that had already been signed by validators, causing the system to recognize the same deposit as a separate exchange and refund it again, ultimately leading to funds being paid out multiple times. The attacker executed 8 operations within approximately 90 minutes, gradually increasing the amounts. Chainflip claims to have completed a repair plan and has flagged the stolen funds to relevant authorities in an attempt to recover them, with operations expected to resume as early as Monday, and they will be responsible for compensating affected users for their losses.

According to Bitcoin News monitoring, DART stated that it, along with independent white hat researchers, has recovered over 50 BTC from wallets affected by the COLDCARD entropy vulnerability, completing the transfer before malicious attackers could steal them. DART is a digital asset recovery organization that collaborates with white hat researchers to protect vulnerable funds and coordinates their legal return to the owners.The white hat researchers did not request a bounty and will return the Bitcoin to the owners. The recovered BTC has been transferred to the Crypto Recovery Trust. This trust is a dedicated statutory trust established under Wyoming state law to hold recovered digital assets and return them after confirming and verifying the legitimate owners.The trust will document the recovery process, separating the BTC from DART and the researchers' funds, conducting blockchain analysis, ownership verification, and sanctions screening, and providing a legal return process for verified owners. If there is a dispute over ownership, or if the related funds are involved in sanctions or criminal proceedings, the BTC will be handled according to applicable legal procedures. DART stated that other vulnerable assets and recovery leads are still under review.

Cronos confirmed in a post-mortem report that the attack on the lending platform Tectonic on August 30 involved $120.4 million in borrowing activities. The validators made the "difficult decision" to roll back the on-chain history, successfully recovering approximately $111.2 million (about 92% of the affected funds), while about $9.19 million flowed out before the network was paused and could not be recovered. The attacker leveraged weak DEX liquidity to inflate the price of Tectonic token TONIC by about 100 times within minutes and borrowed $120.4 million through a single transaction across nine markets. The validators paused the network about two hours later, restoring the chain to the last block before the suspicious activity, with block production resuming approximately 11 hours after the attack. The rollback involved reversing 1 hour and 54 minutes of on-chain history, totaling 10,961 blocks, with all transactions within that window being canceled, regardless of whether they were involved in the attack. Cronos stated that the alternative would have been to restart the network without restoring the previous state, which would have left the stolen assets in the hands of the attacker. This rollback closely followed Harmony's announcement of a similar plan, while Flow abandoned its rollback proposal last December due to community opposition. The validator cap for Cronos is 100, which facilitated quick coordination for the pause and restart, but also indicated that the network's finality in emergencies depends on validator consensus.