Bitget被盗3.87亿美元：年内最大安全事件追踪

Bitget被盗3.87亿美元：年内最大安全事件追踪

持续追踪Bitget约3.87亿美元资产被盗事件进展，聚焦事件时间线、攻击路径、资金流向及后续调查。

23 articles
THORChain responds to criticism over "handling hacker funds": a decentralized, permissionless protocol cannot refuse
PANews reported on September 27 that, in response to criticism from on-chain tracking platform MistTrack that THORChain has repeatedly been used to transfer stolen funds from exchanges such as Bybit and Bitget, THORChain said it is saddened by the recent attacks on related exchanges, while emphasizing that, like Bitcoin, Ethereum and BNB Chain, it is a decentralized and permissionless protocol. It asked in return: "What responsibility should Bitcoin, Ethereum and BNB Chain bear when they process known stolen funds?" Earlier news reported that the Bitget CEO called on THORChain to refuse to provide services to attacker addresses.
AMLBot: Part of Bitget's stolen funds being mixed via Wasabi CoinJoin
PANews, September 27 — According to monitoring by AMLBot, the funds stolen from Bitget appear to have begun being "laundered" through Wasabi CoinJoin (a coin mixing service). Its tracking shows that roughly 4 BTC in a certain CoinJoin round can be traced back to a TRON wallet of Bitget: the relevant funds were first swapped from TRX to USDT, bridged to Ethereum via USDT0 and exchanged for about 145 ETH, then swapped for about 4.59 BTC through THORChain, and finally entered CoinJoin after being split up.
Ripple cannot freeze native XRP as Bitget hacker moves $83 million in stolen assets
PANews reported on September 26, citing CoinDesk, that the Bitget hacker has moved roughly $83 million worth of XRP from three stolen XRP-holding addresses. Of the approximately 103 million XRP originally stolen, about $75 million remains spread across five initial receiving addresses. On-chain data shows that two of the addresses, which each originally held 20 million XRP, have been nearly emptied, with only about 23 and 55 XRP respectively remaining as of 12:41 UTC on Saturday, while the third address's balance has dropped to roughly 5.8 million XRP.
Bitget CEO calls on THORChain to refuse service to attacker addresses
PANews reported on September 26 that Bitget's CEO stated the addresses linked to the Bitget attacker have been made public and are under continuous tracking. Bitget is formally requesting that THORChain refuse to provide services to these addresses, saying decentralization is a design principle and should not become a "shield" for helping process known stolen funds, adding that "the entire industry is watching this matter."
Bitget Launches Stolen Fund Recovery Bounty Program: 5% Reward Each for Freezing and Recovery
PANews reported on September 26 that Bitget CEO Gracy Chen stated on X that the Bitget recovery bounty program is now live: a 5% reward for facilitating the freezing of attacker funds, and an additional 5% reward for successfully recovering funds. She called on exchanges, security researchers, and on-chain investigators to participate in tracking and recovery, and thanked Circle and Tether for quickly taking freezing measures.
Bitget hacker suspected of withdrawing $1.23 million from Binance before transferring funds back to hacker address
PANews reported on September 26, according to Lookonchain, that an address suspected to be related to the Bitget hack withdrew and transferred approximately $1.23 million in funds from Binance. Monitoring shows that wallet address "0x4885" first withdrew 257.6 ETH (about $692,000) and 545,000 USDT from Binance, then swapped all 545,000 USDT for 200.2 ETH. The address subsequently transferred its accumulated 457.9 ETH (about $1.23 million) in full to a wallet associated with the Bitget hacker.
Bitget CEO and other executives to hold a live AMA of at least 2 hours on September 28 at 15:30
PANews reported on September 26 that Bitget CEO Gracy Chen and Bitget Greater China head Xie Jiayin will hold a live AMA of at least 2 hours on September 28 at 15:30 UTC+8, answering community questions about the course of events, progress on resuming withdrawals, and follow-up plans. Earlier today, Bitget announced its withdrawal resumption plan, opening withdrawals for various tokens in phases from September 28 to October 2.
Bitget公布提现恢复计划，9月28日至10月2日分阶段开放各币种提现
PANews 9月26日消息，Bitget称已确认并修复9月24日发生的安全事件相关漏洞，用户账户余额未受影响，平台保护基金将承担本次平台级事件的财务影响。当前提币仅为安全原因暂时暂停，与用户资产可用性无关，交易与充值正常。Bitget计划分阶段恢复提币：9月28日8:00（UTC）开放BTC提币；9月29日8:00开放ETH（含BSC、Arbitrum、Base、Optimism）提币；9月30日8:00开放USDT（Ethereum、BSC、Solana、Tron）；10月2日8:00起恢复其他代币、法币及P2P提币，期间将继续由内部与外部安全团队进行基础设施验证与审计。
CZ posts support for Bitget: Binance, BNB Chain ecosystem and community will do their best to help
PANews, September 25 - Binance co-founder CZ posted on X: "It's a tough day for Bitget. I expect and know that Binance, the BNB Chain ecosystem and the community will do everything they can to help." CZ also said: "Stay SAFU."
Bitget CEO: Stolen funds revised to $387.5 million, withdrawal plan to be announced on September 26
PANews reported on September 25 that Bitget CEO Gray Chen stated that after the security incident on September 24 (UTC), on-chain tracking confirmed that the attacker's address received a total of $387.5 million in assets, revised upward from the previously announced $351.6 million. The revised amount includes Zcash and TRON assets that were not fully counted previously, and does not represent newly stolen funds. No unauthorized transfers have occurred since the incident, and the situation remains under control.
Bitget Launches Recovery Bounty Program and Rolls Out Real-Time Stolen Fund Tracking System
PANews, September 25 — Bitget announced the launch of its fund recovery bounty program, the "Recovery Bounty Program," mobilizing exchanges, blockchain projects, security researchers, investigators, and the on-chain community to assist in freezing and recovering affected assets. Under the program, successfully frozen funds may earn a reward of 5% of the frozen amount for eligible participants who directly contributed to the freeze, and successfully recovered funds may likewise earn a reward of 5% of the recovered amount. Bitget will also use Bybit's Lazarus Bounty program as a core channel to support this bounty and recovery effort. Actions taken through court orders, law enforcement requests, or other legal proceedings are not eligible for rewards, and final reward eligibility, contribution determination, and amounts will be decided by Bitget.
Tether reportedly freezes Bitget hacker address involving 218,000 USDT
PANews reported on September 25 that, according to monitoring by community users, both Circle and Tether have responded with freezes in the Bitget theft case. As of 13:00 (UTC+8) today, Circle had frozen approximately 100,000 USDC; at 20:19 (UTC+8), Tether further froze 218,022.966977 USDT, involving the address 0xe07b…7d57. Monitoring shows that after the attacker converted the stolen TRX into USDT in batches, the funds typically stayed at the controlling address for only about 1 to 8 minutes before being converted into BTC via Stargate or directly through THORChain, leaving Tether a short window to freeze the relevant USDT.
Bitget reminds users to beware of impersonated official accounts and suspicious links, advises verification through official channels
PANews, September 25 – Bitget issued a notice reminding users to stay vigilant and verify before interacting with any Bitget-related accounts, messages, or links, cautioning against impersonated official accounts and suspicious links claiming to be from Bitget. Users can use Bitget's official channel verification page, select platforms such as X, Telegram, or the official website, and enter the relevant URL to confirm whether it is an official channel.
Bitget Hit by $350 Million Hack: How Can the Stolen Funds Be Traced?
How do exchanges, cross-chain protocols, and law enforcement collaborate to recover assets? An analysis of the asset-recovery process and industry mutual assistance.
Bitget CEO: Working with independent third-party experts Mandiant and SlowMist to investigate security incident
PANews reported on September 25 that Bitget CEO Gracy Chen stated the company is working with independent third-party experts Mandiant and SlowMist to conduct a comprehensive investigation into the incident. In addition, Bitget Wallet is a self-custodial wallet running on infrastructure completely separate and independent from Bitget Exchange, and was not affected by the incident. Functions such as deposits, trading, and rewards on the Bitget Exchange platform continue to operate normally. Withdrawals are temporarily suspended while additional security checks are completed; they will be resumed as soon as possible once it is confirmed safe to do so.
Bybit CEO: Team ready to assist Bitget in any way possible
PANews, September 25 — Bybit CEO Ben Zhou posted that the Bybit team is ready to provide Bitget with any assistance within its power. Bitget had previously offered help when Bybit suffered a hacker attack.
Bitget: Losses to be covered by Protection Fund, which holds 5,500 BTC worth about $464 million
PANews reported on September 25 that Bitget issued an official post explaining the status of its Protection Fund. The fund holds 5,500 BTC, worth about $464 million at current prices, and all wallet addresses are public and can be verified on-chain at any time. The fund is specifically used to address platform-level threats such as cybersecurity incidents, in order to protect user assets. Bitget stated that, after assessment, the losses caused by this hot wallet incident will be covered by the Protection Fund, and the fund will be replenished. Specific details and compensation terms will be announced separately.
Xie Jiayin: A third-party security team has been commissioned to conduct an independent forensic investigation into the Bitget attack
PANews reported on September 25 that Xie Jiayin, head of Bitget's Chinese-speaking region, posted that a third-party security team has been commissioned to conduct an independent forensic investigation into this incident. Multiple teams are working together to verify remedial measures, confirm the attack path, and assist with law enforcement cooperation. Once the matter is settled, the investigation results will be shared in a timely manner. After all potential risks are eliminated, withdrawals will be reopened as soon as possible.
Specter: Bitget Attack Linked to North Korean Hacking Group Lazarus Group
PANews, September 25 — According to monitoring by Specter, the Bitget hacking incident is linked to the North Korean hacking group Lazarus Group. The incident is connected to the AFX attack that occurred in July this year, which caused losses of approximately $24 million and was attributed to TraderTraitor, a group associated with Lazarus Group.
Bitget stolen assets include XRP, ETH, BNB, XAUt, AVAX, TRX and more
PANews reported on September 25 that, according to Lookonchain monitoring, the funds stolen from Bitget mainly include: 102.93 million XRP (approximately $157.48 million), 31,890 ETH (approximately $85.75 million), 34.75 million USDT, 21.05 million USDC, 19.67 million USD₮0, 3,000 XAUt (approximately $12.82 million), 12,719 BNB (approximately $9.88 million), 821,012 AVAX (approximately $8.38 million), and 20.59 million TRX (approximately $7.07 million).