News linked to both this project and an event.
OneKey founder Yishi issued a warning that as Bitcoin ETF holdings increase, the security risks faced by custodians are also rising, and noted that BlackRock's spot Bitcoin ETF (IBIT) could become a potential target for North Korean hacking groups. The post states that TRM Labs is highly confident the recent Binance security breach is linked to the North Korean hacking group TraderTraitor, which has previously been implicated in the Bybit hack and the DMM Bitcoin theft.
Odaily reports: Jiang Zhuoer, founder of Litecoin Pool, posted on X platform that Binance's potential loss accounts for a limited proportion of user assets and is not expected to trigger a large-scale wave of withdrawals.He compared this situation with the Bybit theft incident in February 2025: Bybit was hacked for approximately $1.46 billion at the time, accounting for 9.01% of its approximately $16.2 billion in user assets; if Binance's gross outflow this time is $5.64 billion, of which $3 billion has been frozen, the net amount after deduction would be approximately $2.64 billion, accounting for 1.6% of its approximately $165.12 billion in user assets.In addition, the gross outflow may also include internal fund transfers by the platform and normal user withdrawals, and cannot all be regarded as stolen funds. Binance is capable of bearing the relevant losses.
According to official sources, in response to recent security incidents involving Bybit, Bitget, and Binance, OKX founder and CEO Star stated that security should not be an area of commercial competition, but rather a shared responsibility of the entire crypto industry. Over the past decade, major exchanges have made significant progress in private key protection, but potential risks remain in access control and wallet management systems. He emphasized that no system is absolutely secure, and any major security breach at any exchange could undermine trust in the entire industry.Star called on major exchanges in the crypto industry to strengthen cooperation and jointly establish stricter industry security standards and coordinated response mechanisms, including adding verification and security delays for large withdrawals to unknown addresses and smart contract authorization transactions, and implementing key security restrictions at the cryptographic signing layer. Meanwhile, the industry should establish real-time security incident reporting, joint monitoring of suspicious funds, and rapid response mechanisms, and promote collaborative research in areas such as quantum-resistant cryptography and AI-driven security threat defense. He emphasized that no single company can safeguard the future of the crypto industry alone.
OKX founder Star stated that following a series of security incidents at Bybit, Bitget, and Binance, he called on industry CEOs to join forces and establish stronger security standards and coordinated response mechanisms, including mandatory security restrictions at the signature layer, real-time incident reporting, and rapid freezing of stolen assets.
Blockaid CEO Ido Ben-Natan stated that the preliminary assessment indicates Binance was either hacked or had its private keys "abused" due to a compromised signing infrastructure, rather than a private key leak, and noted that it is highly similar to the Bybit theft incident.
Bybit founder and CEO Ben Zhou stated that reports of security incidents at multiple platforms are circulating on social media. Bybit has not been affected in any way, its systems are operating normally, trading and withdrawal functions remain available, and user assets are secure. Bybit is willing to provide support to Binance in multiple areas.
据 Cointelegraph 报道，安全公司 Hacken 发布 2026 年 Q3 报告显示，第三季度加密货币黑客攻击事件共 107 起，总损失达 11.8 亿美元，为 2025 年 Q1 Bybit 事件（损失 16 亿美元）以来最严重的季度。 其中 77%（约 9.06 亿美元）损失源于第三方供应商、开发工具或未纳入安全审计的基础设施漏洞。四大主要事件分别为：Bitget 黑客攻击（3.87 亿美元）、Liquid Network 漏洞（3.2 亿美元）、Tectonic 漏洞（1.2 亿美元）及 Coldcard 固件漏洞（1.15 亿美元），合计占总损失约 80%。智能合约为最高频攻击向量，涉及 71 起事件，损失 2.28 亿美元。 在资金追回方面，约 3.87 亿美元（33%）被归还或逆转，其中"白帽黑客"归还 Liquid Network 被盗资金 2.72 亿美元，Cronos 验证者回滚 114 分钟区块链历史追回 1.11 亿美元；运营商另行垫付 4.1 亿美元补偿用户损失，但仍有约 3.84 亿美元（32%）既未追回也未获赔付。
Odaily News: Security firm Hacken disclosed that a total of 107 cryptocurrency hacking incidents were recorded in Q3 2026, with total losses amounting to $1.18 billion. Of that, approximately $906 million stemmed from compromised vendors, developer tools, disclosed but undeployed fixes, and infrastructure outside audit scope, accounting for roughly 77% of quarterly losses.Quarterly losses were mainly concentrated in four incidents: crypto trading platform Bitget suffered $387 million in losses from an attack, Liquid Network lost $320 million to exploitation, Tectonic lost $120 million to exploitation, and a Coldcard firmware vulnerability caused approximately $115 million in losses. About 80% of losses were concentrated in the above incidents, while 98 incidents resulted in losses below $10 million, with a median of $670,000.Smart contract incidents were the most common attack type, involving 71 incidents and causing $228 million in losses. Q3 was the most severe quarter for losses since Q1 2025, when a $1.4 billion loss by Bybit pushed the quarterly total to $1.6 billion.Approximately $387 million of Q3 losses were returned or reversed, accounting for about 33% of gross losses. Among these, about $272 million was returned in the Liquid Network incident; the Tectonic incident reversed approximately $111.2 million in lending impact by rolling back 114 minutes of blockchain history, and Circle and Tether also froze approximately $340,000 related to funds stolen from Bitget. Operators additionally absorbed $410 million in user losses, leaving approximately $384 million still not returned or covered. (Cointelegraph)
Odaily News: On-chain detective ZachXBT posted on X that he once posed as a client to infiltrate a criminal group suspected of laundering money for the North Korea-backed hacker organization Lazarus Group, and assisted in freezing funds related to the 2025 Bybit attack.ZachXBT stated that after Bybit suffered a $1.5 billion attack in February 2025, he discovered that more than 15 accounts in public Telegram and Discord groups were seeking help processing transactions related to the stolen funds. He subsequently contacted one of the Telegram users using the alias "Jimmy Green" and built trust through multiple transactions. According to his disclosure, on March 6, 2025, he transferred $3.497 million in USDC to an Ethereum address for a USDC-to-TRON-chain USDT exchange transaction with the counterparty. The source of gas funds for that address can be traced back to the Bybit attack funds and was publicly flagged as a Bybit attack blacklisted address.ZachXBT said that in subsequent communications, the counterparty revealed that their team had been involved in processing the stolen Bybit funds and disclosed in advance that the funds would be moved across chains including Solana. By matching transaction timing, amounts, and on-chain data, he identified a wallet cluster involving more than $12 million in Bybit attack funds, with fund paths spanning multiple networks including BTC→ETH→SOL→TRON. Approximately 442,000 USDT was frozen by Tether, and the group also attempted to launder money through Uniswap liquidity pools and low-liquidity tokens. Additionally, the counterparty disclosed having helped other clients process approximately $3 million in fraudulent proceeds, and ZachXBT traced the related funds to wallets associated with the sanctioned Huione Guarantee.ZachXBT revealed that in this investigation, he initially invested $3.497 million and bore a loss risk of approximately 5% per transaction. The intelligence ultimately obtained was provided to relevant investigative agencies and law enforcement authorities at the earliest opportunity. Since 2022, he has assisted in freezing over $75 million in funds related to North Korea-linked incidents.
Greenfield Capital has filed a complaint with the Swiss federal foundation regulator ESA regarding governance issues at the Safe Ecosystem Foundation, alleging that Safe Foundation directors instructed personnel to hand over a substantial amount of SAFE tokens following the Bybit hack, and threatened to force Gnosis to sell its holdings—which account for approximately 10% of the total SAFE supply—and sever ties with Safe.
Odaily News — According to monitoring by the Drift Foundation, the Drift Foundation has released an update on fund recovery progress related to the April 1 security incident: approximately $295 million in user assets were stolen. The foundation has engaged Mandiant, zeroShadow, and SEAL 911 to conduct the investigation and trace the funds, with Mandiant identifying the attacker as the North Korean threat group UNC6862.The stolen funds were subsequently bridged to Ethereum, with approximately 130,300 ETH distributed across 4 wallets. Three of these wallets have seen no transfers to date, collectively holding 107,200 ETH; the other wallet transferred approximately 23,100 ETH to Tornado Cash on July 23.Currently, approximately $9.2 million in stolen funds has been frozen. The relevant funds had previously been transferred through Tornado Cash in August, and unfreezing and return still require cooperation with legal procedures. The Drift Foundation will transfer all assets recovered through freezing, bounties, or law enforcement channels into the DFX recovery pool, and is evaluating the subsequent path of the DRIFT token within the broader ecosystem. In addition, the foundation has partnered with Bybit to launch a public bounty program, offering a 10% bounty on successfully recovered funds.
Odaily News — Gracy Chen, CEO of cryptocurrency exchange Bitget, said the company is not optimistic about recovering the $388 million in crypto assets lost in last week's security incident. Citing the Bybit hack in 2025 as a reference, she noted that approximately one year after that incident, only about 3.5% of the stolen funds had been frozen, and that this does not equate to a completed recovery.Bitget has set up a bounty program offering 5% rewards for frozen funds and recovered funds respectively. The NEAR Intents team said it has intercepted over $50 million in assets related to the attack and frozen approximately $500,000. Tether and Circle have blacklisted the relevant wallets, freezing $318,000 worth of USDT and USDC.Gracy Chen stated that preliminary investigations indicate the attack may match VPN addresses used by North Korea-linked groups, but Bitget has not yet fully ruled out the possibility of an insider job. Bitget has resumed withdrawals in phases, starting with Bitcoin transactions on Monday and continuing with ETH transactions on Tuesday. (Cointelegraph)
Odaily News: According to on-chain analyst Yu Jin, over 90% of the funds swapped cross-chain through THORChain are illicit or grey-market funds. Yu Jin stated that most of the funds stolen from Bybit last year were transferred through THORChain, which collected nearly $10 million in fees within 10 days. Recently, some of the funds stolen from Bitget have also been transferred through THORChain, generating $1 million in fee revenue.
MistTrack (@MistTrack_io) disclosed that, following the transfer of nearly $1.2 billion in stolen funds from last year's $1.46 billion Bybit hack via THORChain, Bitget has recently suffered another major security breach, with stolen funds suspected of again flowing through THORChain. In response, the official THORChain team stated that its protocol is a decentralized, permissionless network, just like Bitcoin, Ethereum, and BNB Chain.
Odaily reports: Xie Jiaxin posted on X stating that this Bitget security incident involved multiple non-EVM chains and 10 tokens, and due to the different method of asset theft, different approaches to handling and restoring withdrawals were taken compared to last year's Bybit security incident in order to thoroughly eliminate potential risks.Additionally, Xie Jiaxin stated that he and Bitget CEO Gracy Chen will host a community livestream 30 minutes before withdrawals resume on Monday to discuss this security incident and answer community questions.Bitget announced on X that it will restore withdrawals in phases: Bitcoin network withdrawals will resume on September 28 at 8:00 (UTC); ETH withdrawals on Ethereum, BSC, Arbitrum, Base, and Optimism networks will resume on September 29 at 8:00 (UTC); USDT withdrawals on Ethereum, BSC, Solana, and Tron networks will resume on September 30 at 8:00 (UTC); other tokens, fiat, and P2P withdrawals will resume on October 2 at 8:00 (UTC). Trading and deposit services continue to operate normally, and users do not need to take any action in advance.
Bitget CEO Gray Chen posted on X platform that following the security incident, on-chain tracking confirmed the attacker's address received a total of $387.5 million in assets, revised upward from the previously disclosed $351.6 million.Gray Chen stated that the revised amount incorporates Zcash and TRON assets that were not fully accounted for previously, and does not represent newly stolen funds. No unauthorized transfers have occurred since the incident, and the situation remains under control. Bitget has launched a Recovery Bounty Program, offering a 5% bounty to each party that voluntarily assists in freezing the attacker's funds or recovering the funds. The exchange has also launched a real-time tracking dashboard, an information submission portal, and an attacker address API, while supporting reports submitted through Bybit's Lazarus Bounty platform. Bitget is currently making full preparations to resume withdrawals, with a specific withdrawal plan to be announced before 4:00 AM (UTC) on September 26.
Bybit co-founder and CEO Ben Zhou announced in a post that the Bybit team stands ready to assist in any capacity with the recent hacking incident targeting Bitget. Previously, when Bybit was compromised, Bitget provided support. Ben Zhou stated that Bybit is currently updating the LazarusBounty platform to help Bitget track the flow of the associated funds.
Odaily News: Bybit co-founder and CEO Ben Zhou posted that the Bybit team stands ready to assist Bitget in any way possible, noting that Bitget had previously offered assistance when Bybit suffered a hack attack.Ben Zhou stated that Bybit is updating the LazarusBounty platform to help Bitget track the flow of stolen funds and assist in recovering the related assets.
Odaily News Bybit today released its H1 2026 Risk and Security Report. Following the security incident in February 2025, Bybit has comprehensively upgraded its security architecture, transitioning toward a new defense model characterized by earlier detection, faster response, and continuous adaptation. Key highlights from the report are as follows:User Fund Protection: In H1, over 30,000 suspicious withdrawals were intercepted, protecting nearly 20,000 users from potential losses exceeding $700 million. The average initial review time was just 4.7 minutes (with 95% completed within 10 minutes).100% On-Chain Monitoring: Monitoring covers all business-related on-chain activities (including listed tokens, ecosystem contracts, and hot/cold wallets). In H1, 10 security incidents involving listed token projects were handled with zero platform losses; of these, responses to 8 incidents were faster than other major exchanges, and 2 attacks were detected before the project teams themselves. Additionally, approximately $212 million in potentially fraudulent on-chain funds was identified, and over 10,000 malicious addresses were blacklisted.AI-Driven Security Operations: More than 100,000 security alerts were processed. AI-assisted audits identified critical vulnerabilities at an efficiency 3-5 times that of manual efforts; the automated red team platform reduced the time from asset discovery to initial testing to within 24 hours (compared to weeks with traditional manual methods), and the cycle from security assessment to testing was shortened from two weeks to two hours.Accountability and Asset Recovery: In collaboration with law enforcement agencies and blockchain intelligence firms, stolen assets are being traced, and legal action has been taken against North Korea and the Lazarus Group to hold them accountable and recover funds.David Zong, Head of Risk Control and Security at Bybit Group, stated: "The cybersecurity arms race has entered the era of 'minute-level' response. Leveraging AI to strengthen risk control capabilities and ensuring the security of AI systems themselves is our top priority, but critical security decisions remain centered on human judgment."
Odaily News: The North Korean regime stole at least $2.8 billion in crypto assets between January 2024 and September 2025, increasingly laundering them through established criminal networks. According to a report by the Royal United Services Institute (RUSI), a UK-based defense and security think tank, the funds are believed to support its weapons programs. Stolen tokens frequently change ownership before being converted into cash, with third parties sometimes purchasing them at a discount or mixing them with proceeds from investment scams such as "pig butchering" schemes. Cashing out primarily relies on "money mules" recruited in the Philippines, Indonesia, and China, where stablecoins are typically split up and sold through peer-to-peer markets. After the Bybit hack, ZeroShadow found that TraderTraitor moved funds through over-the-counter (OTC) desks, peer-to-peer traders, and Chinese organized crime syndicates. Bybit has recovered $48.4 million and frozen $30.5 million in assets, accounting for roughly 5% of the stolen amount in total. (Decrypt)