stolen

Cross-chain trading protocol NEAR Intents stated in a post on X that on September 24, Bitget was attacked, resulting in approximately $387.5 million in funds being stolen, most of which were aggregated into Ethereum and converted to ETH. The hacker attempted to transfer over $50 million through NEAR Intents, but ultimately only $166,000 was successfully transferred, while $503,000 was intercepted during the execution process.NEAR Intents indicated that the relevant data comes from on-chain tracking tools, Arkham, internal logs, and risk control layer SHIELD, among other sources. The figures listed are rounded estimates, with an assessment deviation of no more than 10%. SHIELD identified over $50 million in money laundering attempts and has filtered out duplicate flows, of which $166,000 has been successfully transferred, while another $503,000 was frozen midway through execution and remains restricted, pending legal and recovery procedures.NEAR Intents stated: permissionless does not equal neutral, the team refuses to assist in cashing out stolen assets and will forgo the bounty from this incident to allow Bitget to recover funds as much as possible. Bitget previously established a 5% + 5% bounty arrangement. NEAR Intents also mentioned that the protocol will remain permissionless but set boundaries, and will combat money laundering of stolen funds, while suggesting Bitget contact legal and law enforcement channels to handle the frozen funds.

According to on-chain analyst Yu Jin's monitoring, over 90% of the funds exchanged across chains through THORChain are from illicit sources. Yu Jin stated that most of the stolen funds from Bybit last year were transferred via THORChain, which collected nearly 10 million dollars in fees within 10 days; recently, part of the stolen funds from Bitget has also been transferred through THORChain, with its fee income reaching 1 million dollars.

Bitget CEO Gracy Chen stated on the X platform that the Bitget bounty recovery program has been launched: a 5% reward for facilitating the freezing of the attackers' funds, and an additional 5% reward for successfully recovering the funds. She called on exchanges, security researchers, and on-chain investigators to participate in tracking and recovery, and thanked Circle and Tether for their swift freezing actions.According to previous reports, Circle and Tether have frozen 218,023 USDT and 99,990 USDC in addresses related to the Bitget attack, totaling approximately $318,000. Bitget stated that the attack resulted in losses of about $351.6 million, with the attackers breaching the wallet service backend system, forging transfer information, and triggering the authorization signature process, ruling out private key leakage.

Bitget TradFi Chief Growth Officer Xie Jiayin issued an update on the platform's security incident, stating that the withdrawal time will be announced before noon tomorrow. The security team has identified the hacker's attack path and methods, and has grasped the details of how the attacker bypassed security measures, coming very close to tracing the source of the attack. The incident investigation by third-party security teams Mandiant and SlowMist is still ongoing, with a detailed report pending from the security team.On-chain tracking confirms that approximately $387.5 million has been transferred to the hacker's address, previously estimated at $351.6 million. This revision includes ZEC and TRX, and no other unauthorized transfers have been found. Xie Jiayin stated that the stolen funds at the platform level will be fully covered by the Bitget User Protection Fund, ensuring that user assets are not subject to any losses.Bitget has officially launched a fund recovery bounty program, offering a 5% bounty for voluntarily freezing the attacker’s funds and a 5% bounty for voluntarily recovering funds. The bounty also applies to assistance already provided. The platform has published the attacker's address, a real-time tracking dashboard, and a submission portal, with relevant information also available for submission through Bybit's Lazarus bounty platform.

According to on-chain data, Tether has successfully frozen 218,000 USDT in the stolen address from Bitget, which is a "three-hop" associated address of the initial stolen address from Bitget. This address remained inactive for over 2.5 hours after being discovered.Crypto KOL tanuki42 initiated a tracking of "Circle vs Tether" at that time and asked which of the two companies would freeze the related assets first.Currently, Circle has frozen the related stolen assets 7 hours and 18 minutes earlier than Tether.

According to on-chain analyst tanuki42, the address 0xe07 holds 100,000 USDC and 218,000 USDT, which come from the initial address of stolen funds from Bitget. This batch of funds has been idle for over 2.5 hours, after which they publicly called on Circle and Tether to freeze the assets.At 5 PM, crypto researcher SomaXBT posted that Circle has frozen the USDC assets and specifically called on Tether to follow up. As of the time of publication, Tether has not responded.

Binance Co-CEO Richard Teng stated that since the discovery of the security incident at Bitget, the Binance security team has been closely collaborating with Bitget to assist in sharing security intelligence, tracking related funds, and supporting asset recovery efforts.Richard Teng mentioned that in such security incidents, the cryptocurrency industry will unite to respond to attackers, and the relevant assistance work is still ongoing.

According to monitoring by Blockaid, Limit Break on Ethereum is currently facing ongoing attacks. The attackers are using Limit Break Payment Processor V2 to impersonate NFT holders and purchase authorized NFTs at a zero price. Currently, about 3 transactions have resulted in approximately 1.7 million dollars worth of NFTs being stolen.Blockaid reminds users who have authorized Payment Processor V2 as an NFT Operator to immediately revoke the relevant authorization. Simply canceling orders or Master Nonce will not lift this permission.

According to on-chain detective Specter, by tracking on-chain fund flows, the North Korean hacker organization Lazarus Group may be the behind-the-scenes attacker of the Bitget theft incident. This incident is linked to the AFX attack that occurred in July this year, which resulted in losses of approximately 24 million dollars and was attributed to TraderTraitor associated with Lazarus Group.The stolen XRP from Bitget, after cross-chain transfer, can be directly linked to the stolen funds in the AFX attack.

According to monitoring by Lookonchain, Bitget was attacked this time with stolen assets valued at approximately 356.86 million USD. Among them, 102,926,478 XRP (157.48 million USD) and 31,890 ETH (8.575 million USD) are the main parts of the stolen assets.The remaining stolen assets include 34,751,168 USDT (34.75 million USD), 21,056,725 USDC (21.06 million USD), 19,668,852 USD₮0 (19.67 million USD), 3,000 XAUt (12.82 million USD), 12,719 BNB (9.88 million USD), 821,012 AVAX (8.38 million USD), and 20,593,377 TRX (7.07 million USD).

Bitget CEO Gracy Chen stated during a live broadcast regarding the platform's attack incident that some of the affected funds may have a chance of being recovered. Regarding the resumption of withdrawals, Gracy Chen mentioned that Bitget needs to first investigate the relevant issues thoroughly. The technical team is currently advancing system repairs and security enhancements. The platform will only reopen the withdrawal function after confirming the system's security and ensuring that resuming withdrawals will not lead to further attacks by hackers.She stated that once a clear time window for the resumption of withdrawals is established, users will be informed immediately and an announcement will be made. Currently, no specific time can be promised, as the platform does not wish to make commitments that cannot be fulfilled.

According to on-chain analyst Yu Jin's monitoring, Bitget's stolen assets this time amount to approximately 351.6 million USD, of which about 192.6 million USD was stolen from the EVM chain, mainly including stablecoins and ETH.In the past few hours, hackers have gradually exchanged the stolen stablecoins and other assets on the EVM chain for ETH. Currently, the relevant hacker EVM address holds approximately 68,500 ETH, worth about 184 million USD.

According to Bitcoin News monitoring, security researchers have found that versions 1.1 and 1.2 of FomoPeek distributed through the Apple App Store contain an iOS exploit framework that can escape the application sandbox, capable of extracting keychain data, wallet files, and mnemonic phrases. SlowMist has linked this application to multiple theft incidents and traced nearly $580,000 worth of stolen USDT flowing into a main address.Users who have installed either version should consider the keys accessible on their iPhone as compromised, generate new mnemonic phrases on a clean device, and immediately transfer their funds.

The firmware vulnerability of the hardware wallet Coldcard in 2021 led to insufficient randomness in some recovery seeds. Since July 30, attackers have transferred approximately 1,600 to 1,800 Bitcoins from affected wallets, involving thousands of addresses, with a valuation exceeding 100 million dollars. Coldcard manufacturer Coinkite stated that it must be assumed that someone is using AI to review its public firmware. This vulnerability has existed for about five years, and whether AI was involved in the related attacks has not been confirmed.Shielded Labs researcher Taylor Hornby used Claude Opus 4.8 audit agent to discover a vulnerability in the Zcash Orchard shielded pool circuit that began in 2022, which could generate an unlimited amount of counterfeit ZEC without detection during testing. Developers completed the fix within a few days, and no theft of coins has been confirmed.Blockchain analysis company Chainalysis statistics show that the on-chain write volume carrying malware instructions and command control information has increased from an average of about 2.06 times to 11.1 times daily, a growth of 440%.

According to CoinDesk, the crypto technology provider Haruko was targeted in a cyber attack earlier this week, affecting 15 clients. The attack exposed clients' read-only exchange API details and trading data. According to insiders, some hedge fund clients with weaker security protections may have had a small amount of funds stolen.Adam Carlile, co-founder and Chief Technology Officer of Haruko, stated in an email sent to clients that this was a targeted attack initiated by an organization, and the affected clients were all non-whitelisted clients. The attackers exploited a vulnerability in one of Haruko's processes to extract user access tokens, thereby obtaining data such as read-only exchange API information stored in process memory; clients' login credentials were not compromised. Haruko has fixed the vulnerability and refreshed the server-side keys, and plans to release a complete technical review report.Based in London, Haruko provides portfolio, risk management, and trading data infrastructure for institutional digital asset companies. The platform connects centralized exchanges, custodians, blockchains, and DeFi protocols, currently serving over 80 clients globally and integrating with more than 100 centralized trading platforms, 30 blockchains, and 250 on-chain protocols. Its listed clients include Bitcoin Suisse, GSR, Flowdesk, 3iQ Digital Assets, M2, among others, with GSR stating that it was not affected by this incident.

The cross-chain protocol Chainflip disclosed that an attack incident targeting Tron USDT occurred yesterday. It has been confirmed that 736,442.17 USDT was stolen through 6 unauthorized payments, and an additional 115,654.41 USDT from user exchanges remains in the vault due to payment failures, while other funds were unaffected.Chainflip stated that the attacker exploited a vulnerability in the Tron transaction memo mechanism, attaching a custom memo to transactions that had already been signed by validators, causing the system to recognize the same deposit as a separate exchange and refund it again, ultimately leading to funds being paid out multiple times. The attacker executed 8 operations within approximately 90 minutes, gradually increasing the amounts. Chainflip claims to have completed a repair plan and has flagged the stolen funds to relevant authorities in an attempt to recover them, with operations expected to resume as early as Monday, and they will be responsible for compensating affected users for their losses.

Blockstream tweeted that it will not pay a ransom for the return of the stolen Bitcoin from the Liquid Network, stating that acquiring assets without authorization and refusing to return them constitutes theft, which does not fall under responsible disclosure or white hat behavior.Blockstream stated that if the stolen funds are not returned, it will cooperate with law enforcement agencies, exchanges, service providers, and forensic experts to track, recover the assets, and identify the responsible parties through all legal means, while emphasizing that Bitcoin transactions are transparent and relevant evidence will not disappear. Blockstream is the main developer and technical provider of the Liquid Network. Liquid Network stated that "approximately 4,000 BTC were taken by white hat hackers," and the sidechain has therefore suspended operations.

Cardano ecosystem project Empowa disclosed that two interconnected unauthorized asset transfer incidents occurred involving its three project wallets. Between November 2025 and June 2026, approximately 143,710 ADA was transferred out in 18 transactions from one project treasury wallet, which was also registered and claimed by unknown individuals using the private key corresponding to the Midnight airdrop, of which about 36,000 NIGHT has been transferred away.From June to August 2026, approximately 4.24 million EMP was transferred out from the other two project wallets, some of which have been sold through Minswap, VyFi, and others. Empowa stated that the funds from the two incidents ultimately flowed to the same intermediary wallet, indicating control by the same party, but the identity of the individuals operating these private keys cannot currently be confirmed. The project team has hired a professional blockchain investigation agency and plans to seek KYC information through the centralized exchanges where the relevant funds ultimately entered.

A Hyperliquid user account was unauthorizedly controlled, approximately 738,600 USDC was transferred away, and another 10,287 HYPE was unstaked. The victim account belongs to a certain address, and part of the stolen funds flowed to addresses suspected to be related to Bitget. As of the time of verification, 10,287 HYPE remains in the staked balance and has not yet entered the withdrawal queue.If the attacker continues to initiate cWithdraw, the related assets will be further transferred after a 7-day waiting period. In two recent similar cases, staked assets were stolen again due to the lack of an emergency pause mechanism that users could trigger, resulting in losses exceeding 1.1 million dollars. Related suggestions include launching a Guardian or Recovery mechanism that users can pre-enable, temporarily pausing withdrawals, transfers, and authorization changes, suspending automatic expiration, and requiring time locks and evidence review for recovery, with records on the blockchain.

On-chain investigator ZachXBT posted on X accusing user "Mr Austin Fine" (account "@xmrfine") of exchanging the stolen cryptocurrency assets of victim Malone for luxury goods in exchange for fees, stating that he "may be a whistleblower." ZachXBT indicated that until the victim is compensated, he will consider him "disassociated," which will negatively impact all current and future brand collaborations.ZachXBT later added that he has traced part of the funds on-chain flowing through Monero to purchase cars from the luxury car dealer TBTFW in Los Angeles.