Bitget被盗3.87亿美元：年内最大安全事件追踪

Bitget被盗3.87亿美元：年内最大安全事件追踪

持续追踪Bitget约3.87亿美元资产被盗事件进展，聚焦事件时间线、攻击路径、资金流向及后续调查。

35 articles
臭名昭著的 Lazarus Group：从加密行业偷走近 78 亿美元的朝鲜黑客帝国
一个藏在 Crypto 世界里的朝鲜国家级灰产
Bitget Protection Fund replenished to $300 million, balance now 3,705 BTC
PANews, September 30 - According to monitoring by Ai Yi, the Bitget Protection Fund has been replenished to $300 million, with the latest balance updated to 3,705 BTC, worth approximately $307 million.
Bitget Protection Fund replenished to $200 million, 2,000 BTC transferred from cold wallet in past 2 hours
PANews, September 30 – According to monitoring by Ai Yi, Bitget has begun replenishing its Protection Fund, which has now returned to $200 million. Over the past 2 hours, 2,000 BTC ($166 million) was transferred from a cold wallet to the Protection Fund address, and the latest on-chain balance currently stands at 2,484.71 BTC, worth $206 million.
Bitget has achieved net capital inflow, with a net inflow of $9.47 million all day yesterday
PANews, September 30 - According to monitoring by on-chain analyst Yu Jin, Bitget is now on its third day of open withdrawals and has already passed the withdrawal peak. Combined with Bitget's multiple customer-retention measures (fixed high interest on stablecoins plus PoolX ETH and BTC locked mining), Bitget's funds have now turned to net inflow. For example, since ETH withdrawals opened yesterday afternoon, inflows have significantly exceeded outflows: roughly 28,900 ETH flowed in and about 7,266 ETH flowed out. The address starting with 0x714 is the largest depositing address, having withdrawn 20,000 ETH (about $54.66 million) from Lido last night and transferred it into Bitget to participate in the ETH pool's 11.27% APR campaign.
SlowMist: Bitget theft can be traced back to August 31, involving a zero-day vulnerability in a third-party product
PANews reported on September 30 that blockchain security firm SlowMist, commissioned by Bitget, launched an investigation into the September 25 hot wallet asset theft and released an interim investigation report. As of September 29, the investigation found malicious activity involving a specific third-party security product and the wallet application host, as well as a highly customized withdrawal tool used by the attacker.
SlowMist's Cos: North Korean hackers use Cow and Chainflip combo for cross-chain, automated scripts move stolen Bitget funds into BTC
PANews reported on September 30 that, according to monitoring by SlowMist's Cos, SlowMist TrackAgent discovered that North Korean hackers used a combination of Cow Protocol and Chainflip to carry out cross-chain operations on stolen Bitget funds. The North Korean hackers' automated scripts created orders through Cow Protocol, with the order's receiving address set to a pre-prepared Chainflip Deposit-related contract address. Once the order succeeded, the cross-chain operation of the assets on Chainflip was completed, converting them into BTC.
Xie Jiayin Responds to Bitget's First Security Incident in 8 Years: Hackers Exploited a Vulnerability in a Third-Party Security Product, Independent Review Launched with Security Firms
PANews, September 28 — According to official sources, Xie Jiayin, Head of Greater China at Bitget, recently addressed community concerns directly in a livestream. He recalled that over its 8 years since founding, Bitget has always placed the security of user assets as its highest priority, successfully fending off multiple cyberattack attempts and maintaining a long-term record of secure operations. This incident marks the platform's first security crisis in its 8-year history. After complete tracing, this incident was a special attack targeting the supply chain of third-party security software. The attacker exploited a vulnerability in a third-party product to obtain internal network credentials, but private keys were not leaked and cold wallet assets were not affected in any way. Bitget has now joined forces with security firms Mandiant and SlowMist to conduct an independent review, and will comprehensively upgrade its monitoring and management standards for third-party components.
Bitget has opened BTC withdrawal services as scheduled
PANews reported on September 28 that Bitget has opened its phased withdrawal function as scheduled, and BTC withdrawal services are now available. According to the previously announced timeline, ETH-related networks will open withdrawals at 16:00 (UTC+8) on September 29, and USDT-related networks will open withdrawals at 16:00 (UTC+8) on September 30; withdrawals for other tokens, fiat and C2C services will gradually resume starting at 16:00 (UTC+8) on October 2. Currently, Bitget CEO Gracy Chen and Greater China head Xie Jiayin are reviewing and explaining this security incident through a public livestream, sharing the latest progress and answering user questions on the spot.
Bitget CEO: Hackers transferred out about $388 million in assets; protection fund will be replenished to over $300 million within a week after use
PANews, September 28 - Bitget CEO Gracy Chen said in a livestream that the attacker exploited a vulnerability in a third-party security product to steal internal network credentials, forged withdrawal instructions to the wallet system, and bypassed risk control checks. Private keys were not leaked, and cold wallets were unaffected. The vulnerability has now been fixed and the incident is fully under control. It has been confirmed that approximately $388 million in assets were transferred out, and the attacker's address and on-chain tracking data have been publicly released. Gracy Chen said the loss will be fully covered by the user protection fund, and Bitget will replenish the protection fund to at least $300 million within one week after the fund is used. Bitget has now launched asset recovery plans and will share the confirmed vulnerability and attack information with relevant industry parties.
Bitget hacker is swapping ETH for BTC via THORChain
PANews, September 28 - According to Lookonchain monitoring, the Bitget hacker who stole $351.6 million is currently swapping ETH for BTC via THORChain.
THORChain clarifies network pause mechanism, emphasizes protocol remains permissionless and neutral
PANews reported on September 28 that THORChain issued an announcement stating that network pausing is an emergency security mechanism designed to protect the protocol. This pause is not a selective freeze targeting specific funds or individual swap transactions. In the May 2026 attack that resulted in $10.7 million being stolen from liquidity pools, the attacker's address was never blacklisted, so they were never prevented from conducting swaps on THORChain. THORChain is permissionless, and its design never included a censorship mechanism. It is a neutral public product or tool.
Refusing to open a "backdoor" for Bitget: the technology and interest game behind THORChain's "double standards"
After THORChain refused to freeze Bitget's stolen funds, its decentralization principles came under question, standing in stark contrast to how it acted after being attacked itself, sparking community debate over the boundary between "protocol neutrality" and "security responsibility."
Decentralization as a shield? THORChain embroiled in "double standard" controversy over whether to block stolen transactions
When its own funds are hacked, it shuts down instantly; when others' stolen money flows through, it keeps washing it.
THORChain responds to criticism over "handling hacker funds": a decentralized, permissionless protocol cannot refuse
PANews reported on September 27 that, in response to criticism from on-chain tracking platform MistTrack that THORChain has repeatedly been used to transfer stolen funds from exchanges such as Bybit and Bitget, THORChain said it is saddened by the recent attacks on related exchanges, while emphasizing that, like Bitcoin, Ethereum and BNB Chain, it is a decentralized and permissionless protocol. It asked in return: "What responsibility should Bitcoin, Ethereum and BNB Chain bear when they process known stolen funds?" Earlier news reported that the Bitget CEO called on THORChain to refuse to provide services to attacker addresses.
AMLBot: Part of Bitget's stolen funds being mixed via Wasabi CoinJoin
PANews, September 27 — According to monitoring by AMLBot, the funds stolen from Bitget appear to have begun being "laundered" through Wasabi CoinJoin (a coin mixing service). Its tracking shows that roughly 4 BTC in a certain CoinJoin round can be traced back to a TRON wallet of Bitget: the relevant funds were first swapped from TRX to USDT, bridged to Ethereum via USDT0 and exchanged for about 145 ETH, then swapped for about 4.59 BTC through THORChain, and finally entered CoinJoin after being split up.
Ripple cannot freeze native XRP as Bitget hacker moves $83 million in stolen assets
PANews reported on September 26, citing CoinDesk, that the Bitget hacker has moved roughly $83 million worth of XRP from three stolen XRP-holding addresses. Of the approximately 103 million XRP originally stolen, about $75 million remains spread across five initial receiving addresses. On-chain data shows that two of the addresses, which each originally held 20 million XRP, have been nearly emptied, with only about 23 and 55 XRP respectively remaining as of 12:41 UTC on Saturday, while the third address's balance has dropped to roughly 5.8 million XRP.
Bitget CEO calls on THORChain to refuse service to attacker addresses
PANews reported on September 26 that Bitget's CEO stated the addresses linked to the Bitget attacker have been made public and are under continuous tracking. Bitget is formally requesting that THORChain refuse to provide services to these addresses, saying decentralization is a design principle and should not become a "shield" for helping process known stolen funds, adding that "the entire industry is watching this matter."
Bitget Launches Stolen Fund Recovery Bounty Program: 5% Reward Each for Freezing and Recovery
PANews reported on September 26 that Bitget CEO Gracy Chen stated on X that the Bitget recovery bounty program is now live: a 5% reward for facilitating the freezing of attacker funds, and an additional 5% reward for successfully recovering funds. She called on exchanges, security researchers, and on-chain investigators to participate in tracking and recovery, and thanked Circle and Tether for quickly taking freezing measures.
Bitget hacker suspected of withdrawing $1.23 million from Binance before transferring funds back to hacker address
PANews reported on September 26, according to Lookonchain, that an address suspected to be related to the Bitget hack withdrew and transferred approximately $1.23 million in funds from Binance. Monitoring shows that wallet address "0x4885" first withdrew 257.6 ETH (about $692,000) and 545,000 USDT from Binance, then swapped all 545,000 USDT for 200.2 ETH. The address subsequently transferred its accumulated 457.9 ETH (about $1.23 million) in full to a wallet associated with the Bitget hacker.
Bitget CEO and other executives to hold a live AMA of at least 2 hours on September 28 at 15:30
PANews reported on September 26 that Bitget CEO Gracy Chen and Bitget Greater China head Xie Jiayin will hold a live AMA of at least 2 hours on September 28 at 15:30 UTC+8, answering community questions about the course of events, progress on resuming withdrawals, and follow-up plans. Earlier today, Bitget announced its withdrawal resumption plan, opening withdrawals for various tokens in phases from September 28 to October 2.