News linked to this event type.
链上侦探 ZachXBT 发文表示，Bitget 被盗事件中疑似朝鲜关联的攻击者已开始将约 2700 枚 ZEC（约 380 万美元）转入 Zcash 的 Ironwood 屏蔽池。Bitget 热钱包此前共被盗约 1.89 万枚 ZEC，价值约 2830 万美元。
Odaily News: Cosine disclosed the interim investigation reports by SlowMist and Google Cloud's Mandiant on the Bitget hot wallet breach. Both reports indicate that the attackers first compromised systems related to third-party security products, then moved laterally into Bitget's wallet business environment.SlowMist's investigation revealed that one of the third-party security product nodes had a zero-day vulnerability, with related malicious activity traced back to as early as August 31. On September 25, the attackers also used an internal employee identity to access the management platform of another third-party security product and used highly customized withdrawal tools to interact with the wallet system's withdrawal logic. Mandiant stated that after gaining persistent access through third-party security devices, the attackers moved laterally to production wallet task servers and deployed malicious programs.Mandiant also stated that no evidence of Bitget private key leakage has been found so far, and cold wallets were not affected. Both security teams are continuing to investigate the specific intrusion paths the attackers took between the relevant systems.
Odaily reports: Bitget stated on X platform that an investigation by Google Cloud's Mandiant into Bitget's September 24 security incident found that attackers gained unauthorized access to certain third-party security devices, then laterally moved into Bitget's exchange wallet environment and obtained access to both warm and hot wallets. The investigation findings are consistent with the attack path previously disclosed by Bitget.
Odaily News — SlowMist security team has disclosed preliminary investigation findings on the September 25 theft of assets from Bitget's hot wallet. The investigation found that the attack involved certain third-party security products and wallet application hosts, with a zero-day vulnerability present in one of the third-party products. The attacker also gained unauthorized access to a third-party product management platform by impersonating an internal employee.SlowMist stated that the team has obtained the custom withdrawal tool used by the attacker to interact with the wallet system's withdrawal logic. On-chain attack activity began at 2:31 on September 25, lasted approximately 2 hours and 52 minutes, and involved multiple blockchains. The attacker subsequently attempted to tamper with withdrawal records and trigger additional BTC withdrawals. The team is still investigating how the attacker moved laterally between the affected systems.
Voting results for the Zcash Q3 Token Holder Targeted Retroactive Funding Program indicate that both bounty proposals for Taylor Hornby, discoverer of the Orchard counterfeit coin vulnerability, have been approved. The awards include a $750,000 vulnerability bounty requested by himself, along with an additional $750,000 bonus nominated by community members, totaling $1.5 million. In accordance with regulations, recipients are required to complete subsequent steps including identity verification (KYC) and fund disbursement.
Odaily News — According to monitoring by SlowMist's Yu Xian, MistTrack_io's TrackAgent discovered that North Korean hackers used automated scripts to create orders on CoW Protocol and set the receiving address to pre-prepared Chainflip Deposit-related contract addresses. After the orders were filled, the relevant assets could complete cross-chain operations on Chainflip and be swapped into BTC. The operation involves stolen Bitget funds.
The Abracadabra community is voting on a proposal for the orderly shutdown of the protocol and its stablecoin MIM (Magic Internet Money). The proposal notes that, affected by factors such as multiple previous hacking attacks, the protocol currently holds approximately $21 million in bad debt. With the circulating MIM supply nearing $22 million and recoverable collateral valued at only around $900,000, the effective asset reserve ratio has fallen below 4%, leaving no viable path to restore the peg.
Yuga Labs Blockchain Vice President Quit (0xQuit) warns that the security vulnerability associated with PPv2 remains actively exploited, leaving even previously unaffected users at risk. Monitoring shows that an address was drained within a single block after accepting a quote and receiving 0.15246 WETH; attackers directed 99% of the illicit proceeds to block builders (Titan Builder), making conventional fund recovery via frontrunning extremely difficult.
— According to Quit monitoring, the Payment Processor V2 (PPV2) exploit attack is still ongoing. Even if users were not affected in the September 25 incident, as long as they have not revoked the relevant approvals, their assets may still be at risk. Users are advised to revoke approvals immediately.About 1 hour ago, an address lost 0.15246 WETH in the next block after accepting a quote and receiving funds. The attacker paid 99% of it as a tip to Titan Builder and kept only about 0.0015 ETH, making it nearly impossible to rescue the funds through frontrunning.Quit suggests that OpenSea could check whether a user still has risky approvals before they accept a quote and require them to revoke them first; when transferring NFTs, it should also check whether the receiving address has any related approvals remaining.
Decentralized exchange protocol Balancer announced that community voting has approved the BIP-928 ordered liquidation proposal, while the fork proposal BIP-929 was not approved. The protocol's liquidity pools will operate normally until October 30, after which they will transition to a "withdrawal-only" mode and the bug bounty program will be simultaneously terminated. V3 vaults are expected to pause on November 30. Due to the non-custodial nature of the smart contracts, liquidity providers can withdraw funds at any time, and relevant withdrawal guidelines will be published prior to October 30.
Odaily News: The U.S. Attorney's Office for the District of Massachusetts filed a civil forfeiture lawsuit on September 28, seeking the forfeiture of 110,300 USDT seized from a Binance account. The case involves phishing text messages impersonating Coinbase, which led to the theft of 33.7 bitcoins, worth approximately $900,000 at the time, from a beneficiary and their family trust held in the same Coinbase account.Investigators said that between June 5 and June 15, 2023, 11.2 of the stolen bitcoins were traced to the Binance account and were quickly converted into Monero. When the FBI requested the account be frozen, it held approximately 758.55 Monero; Binance transferred 110,300 USDT to a government-controlled wallet on August 3, 2026. (Bitcoin.com News)
Odaily reports: The privacy-focused public chain Zano team has stated that in response to the inflation vulnerability discovered last Friday, a hotfix has been deployed, and the network is now running stably on the updated chain. The chain previously rolled back the block height to 3,833,000, erasing 30 days of previously confirmed transaction records.The Zano team stated that third-party wallets, exchanges, and payment service providers must first update their own nodes to the updated chain before they can safely resume transfers of ZANO and Zano-issued assets. Service providers will announce recovery progress through official channels, and recovery procedures for affected users are being prepared.The native asset ZANO has dropped 32% in price this week and 40.6% since the start of 2026. Zano's official X account stated that users can update their iOS, Android, and desktop wallets, and the team will soon release more details on the recovery process. (Bitcoin.com News)
Odaily News — Gracy Chen, CEO of cryptocurrency exchange Bitget, said the company is not optimistic about recovering the $388 million in crypto assets lost in last week's security incident. Citing the Bybit hack in 2025 as a reference, she noted that approximately one year after that incident, only about 3.5% of the stolen funds had been frozen, and that this does not equate to a completed recovery.Bitget has set up a bounty program offering 5% rewards for frozen funds and recovered funds respectively. The NEAR Intents team said it has intercepted over $50 million in assets related to the attack and frozen approximately $500,000. Tether and Circle have blacklisted the relevant wallets, freezing $318,000 worth of USDT and USDC.Gracy Chen stated that preliminary investigations indicate the attack may match VPN addresses used by North Korea-linked groups, but Bitget has not yet fully ruled out the possibility of an insider job. Bitget has resumed withdrawals in phases, starting with Bitcoin transactions on Monday and continuing with ETH transactions on Tuesday. (Cointelegraph)
Bitget confirmed a hack of approximately $351.6 million, with CEO Gracy Chen stating that attackers stole funds by forging transfer requests, and that user assets are fully covered by a protective fund of over $464 million.
Odaily News — Multiple Bitcoin ventures associated with Bitcoin pioneer and Blockstream co-founder Adam Back have recently suffered a series of setbacks: the merger between BSTR Holdings, the Bitcoin treasury project he championed, and a SPAC under Cantor Fitzgerald has been terminated, with BSTR ordered to pay a $15 million breakup fee; Blockstream Mining, the Bitcoin mining operation he co-founded and in which he holds a minority stake, along with its partner Exacore, has faced multiple lawsuits following its spin-off from Blockstream, accused of owing equipment payments, electricity bills, and customer deposits, with related financing totaling approximately $2 billion; meanwhile, Liquid Network, the Bitcoin sidechain initiated by Blockstream, suffered a hack in which approximately 4,000 BTC were stolen, of which 3,400 have been returned, with the hacker still retaining approximately $47 million worth of Bitcoin. (Bloomberg)
according to monitoring by neil lee (@neillee99), they claim to have withdrawn approximately 50 BTC from Binance on July 8, converted it into SolvBTC and BTC+ to earn approximately 3% annualized yield, after which BTC+ minting and redemption functionality was suspended. On July 22, Solv Protocol publicly disclosed the related security incident and stated that assets were not affected; on July 31, the project team said functionality had been restored, but their address remained restricted, and approximately 50 BTC still cannot be redeemed to this day. They claim to have submitted proof of fund sources and wallet control, and called on Binance and investors to pay attention.
Odaily report: According to monitoring by SlowMist's Cos, the Chainflip bridge is attempting to block North Korean hacker money laundering, but the response speed of AML/KYT lags behind the speed of money laundering. Money laundering groups use automation to split funds into large numbers of small amounts, transferring them across chains through various bridges; if funds are intercepted or returned by risk controls, they immediately try the next money laundering path, ultimately converting to BTC and continuing to obfuscate the source of funds through CoinJoin. This money laundering operation is still continuously evolving.
Ari Paul, founder and chief investment officer of digital asset investment firm BlockTower Capital, stated on social media that Coinbase caused his firm to lose $25 million several years ago. Paul accused Coinbase of concealing large-scale, repeated security breaches and refusing to return the related funds.
MistTrack monitoring indicates that a Bitget attacker recently attempted to transfer stolen funds through the cross-chain liquidity network Chainflip, but the deposit was rejected by the relevant broker (Broker). The platform did not freeze the funds, but instead executed a return to the originating address. MistTrack stated it will continue to track the subsequent flow of the stolen funds.
Cross-chain payment and transaction protocol Relay disclosed that a vulnerability in its API interface led to the exposure of pending transaction data. Between September 12 and 26, Maximal Extractable Value (MEV) searchers exploited this flaw to execute sandwich attacks, accumulating approximately $136,000 in profits.