{ "version": 1, "event_id": "evt_6655595dc1e36e0b", "url": "https://xiyu.news/events/evt_6655595dc1e36e0b/", "json": "https://xiyu.news/api/events/evt_6655595dc1e36e0b.json", "type": "security_incident", "status": "closed", "category": "crypto", "title": { "zh": "Bitget 遭黑客攻击约3.516亿美元并暂停提现，资金经跨链兑换洗钱", "en": "Bitget suffers ~$351.6M hack and suspends withdrawals" }, "current_state": { "zh": "Bitget 正逐步恢复正常运营，保护基金规模达到 3.09 亿美元；BTC、ETH 和 USDT 提现已恢复，所有代币提现预计周五恢复。CEO 称事件造成 3.88 亿美元用户损失，仍未排除内部人员或朝鲜黑客等责任方；此前已报告的攻击者将 ZEC 转入 Ironwood 屏蔽池等调查仍在继续。", "en": "Bitget is gradually returning to normal operations, with its Protection Fund reaching $309M; BTC, ETH and USDT withdrawals are restored, and withdrawals for all tokens are expected to resume Friday. The CEO said the incident caused $388M in user losses and that an inside job or North Korean hackers have not been ruled out; prior investigation items such as the attacker moving ZEC into the Ironwood shielded pool continue." }, "first_seen_at": "2026-09-24T23:18:03.365059+00:00", "last_updated_at": "2026-09-30T18:04:19.070907+00:00", "last_material_change_at": "2026-09-30T18:04:19.070907+00:00", "confidence": 0.75, "updates_count": 22, "sources_count": 66, "entities": [ "about", "accounting", "addresses", "affected", "after", "already", "american", "amid", "and", "around", "assets", "aug", "away", "back", "bazaar", "beincrypto", "biggest", "binance", "bitget", "bitget-hack", "block", "breach", "brief", "btc", "but", "bybit", "ceo", "chainfl", "chainflip", "challenges", "chen", "circle", "cites", "claims", "clarification", "climb", "coinfomania", "cow", "cryptonomist", "decentralization", "demand", "estimate", "etf", "etf-inflows", "exchange", "exploit", "exposes", "fallout", "fed", "foresight", "freeze", "from", "funds", "giwa", "gone", "goplus", "gracy", "gradually", "hack", "hacked", "hacker", "hackers", "happened", "here", "hokanews", "hot", "hot-wallet", "hot-wallet-breach", "incident", "intellectia", "intents", "investment", "ironwood", "issues", "korea", "korean", "losses", "million", "morning", "most", "movement", "near", "near-intents", "nearly", "news", "north", "north-korea", "offers", "official", "pluang", "project", "protection-fund", "pushes", "raises", "rate", "recap", "refuses", "rejects", "reopens", "request", "resume", "ripple", "route", "says", "security-breach", "september", "slip", "slowmist", "stablecoins", "stolen", "substack", "suddenly", "support", "suspect", "suspected", "suspends", "swapping", "swiss", "tether", "thorchain", "through", "tied", "timeline", "token", "tradingview", "upbit", "usdt", "vanishes", "wallet", "wallets", "what", "why", "widens", "withdrawals", "xrp", "zec", "zero-day" ], "identifiers": [], "topics": [ "aml-kyt", "asset-recovery", "attribution", "binance", "bitget", "bitget-hack", "btc", "bybit", "censorship-resistance", "chainflip", "circle", "cross-chain", "cross-chain-bridges", "crypto-security", "custody", "custody-risk", "cz", "decentralization", "defi-governance", "dprk", "etf-inflows", "exchange-breach", "exchange-funds", "exchange-hack", "exchange-investment", "exchange-operations", "exchange-reserves", "exchange-security", "exchanges", "fund-recovery", "fund-safety", "fund-tracing", "giwa", "hack", "hacked-funds", "hacks", "hot-wallet", "hot-wallet-breach", "hot-wallets", "incident-response", "industry-response", "institutional-custody", "lazarus-group", "money-laundering", "near-intents", "north-korea", "north-korea-hacking", "on-chain", "on-chain-data", "on-chain-forensics", "on-chain-monitoring", "onchain-forensics", "protection-fund", "protocol-governance", "security-breach", "security-incident", "slowmist", "stablecoin-freeze", "stablecoin-regulation", "stolen-funds", "sygnum", "tether", "thorchain", "thorswap", "upbit", "user-protection-fund", "withdrawal-suspension", "withdrawals", "withdrawals-suspended", "xrp", "xrp-ledger", "zcash", "zero-day" ], "updates": [ { "update_id": "upd_5d96c2f2a2d99557", "event_id": "evt_6655595dc1e36e0b", "occurred_at": "2026-09-24T21:59:32Z", "published_at": "2026-09-24T21:59:32Z", "first_seen_at": "2026-09-24T23:18:03.365059Z", "time_precision": "published", "update_type": "initial", "material_change": true, "title_zh": "加密货币交易所Bitget称黑客攻击影响3.52亿美元，声称用户资金“安全”", "title_en": "Crypto exchange Bitget says $352 million affected in a hack, claims user funds are 'safe'", "what_changed_zh": "Bitget CEO陈樱棋披露了一起安全漏洞事件，热钱包和温钱包遭未授权转账，涉及约3.516亿美元，她表示冷钱包和用户资金安全，提现暂时暂停以待安全审查。", "what_changed_en": "Bitget CEO Gracy Chen disclosed a breach exposing about $351.6 million through unauthorized transfers from hot and warm wallets, saying cold wallets and user funds are safe while withdrawals are temporarily paused pending a security review.", "current_state_zh": "Bitget CEO陈樱棋披露了一起安全漏洞事件，热钱包和温钱包遭未授权转账，涉及约3.516亿美元，她表示冷钱包和用户资金安全，提现暂时暂停以待安全审查。", "current_state_en": "Bitget CEO Gracy Chen disclosed a breach exposing about $351.6 million through unauthorized transfers from hot and warm wallets, saying cold wallets and user funds are safe while withdrawals are temporarily paused pending a security review.", "detailed_summary_zh": "Bitget CEO Gracy Chen disclosed a breach exposing about $351.6 million through unauthorized transfers from hot and warm wallets, saying cold wallets and user funds are safe while withdrawals are temporarily paused pending a security review.", "detailed_summary_en": "Bitget CEO Gracy Chen disclosed a breach exposing about $351.6 million through unauthorized transfers from hot and warm wallets, saying cold wallets and user funds are safe while withdrawals are temporarily paused pending a security review.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 9.5, "references": [ { "url": "https://en.wikipedia.org/wiki/Bitget", "title": "Bitget - Wikipedia" }, { "url": "https://www.investopedia.com/hot-wallet-vs-cold-wallet-7098461", "title": "investopedia.com/hot-wallet-vs-cold-wallet-7098461" } ], "confidence": 0.75, "story_ids": [ "rss:www.coindesk.com_arc_outboundfeeds_rss_:1b10589a8507c69e", "rss:cryptoslate.com_feed_:b061029d7bcbdcd2", "rss:decrypt.co_feed:48e80437d7caa4bc", "rss:www.theblock.co_rss.xml:b2a2d75ef96dbad1", "rss:thedefiant.io_api_feed:e60d246ee5c2df24", "google_news:article:6df83a6563764b27", "rss:cointelegraph.com_rss:205852e2ae6ba20a" ], "sources": [ { "url": "https://www.coindesk.com/markets/2026/09/24/crypto-exchange-bitget-loses-usd352-million-in-hack-claims-user-funds-are-safe", "label": "CoinDesk", "source_type": "rss", "official": false }, { "url": "https://cryptoslate.com/bitgets-351-6-million-hack-pushes-september-crypto-losses-to-2026-high/", "label": "CryptoSlate", "source_type": "rss", "official": false }, { "url": "https://decrypt.co/379275/bitget-hack-183-million-crypto-exchange-wallets", "label": "Decrypt", "source_type": "rss", "official": false }, { "url": "https://www.theblock.co/news/markets/2026-09-24-more-than-170-million-in-crypto-moves-from-bitget-wallets-unidentified-address-416345", "label": "The Block", "source_type": "rss", "official": false }, { "url": "https://thedefiant.io/news/cefi/bitget-disables-withdrawals-165-million-one-address-four-chains", "label": "The Defiant", "source_type": "rss", "official": false }, { "url": "https://news.google.com/rss/articles/CBMidkFVX3lxTE5KbmJ4OE00SE1XVEwwcHVPWDIycUtoSTVEdUx1Z0ZWNEM5a2ZoQXRzenRFUlg5RmZid05hSXV3NERvdzlLM0tmZG04eXZQdk1xNlJzZG0wMlJWZ3RMa0NwYWhxX0ZhZFNMYmRmTmNVWEtFcTZMTmc?oc=5", "label": "finance.biggo.com", "source_type": "google_news", "official": false }, { "url": "https://cointelegraph.com/news/bitget-calls-security-withdrawal-claims-unverified-amid-178m-breach-reports?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound", "label": "Cointelegraph", "source_type": "rss", "official": false } ] }, { "update_id": "upd_74d4ec403dffaaa9", "event_id": "evt_6655595dc1e36e0b", "occurred_at": "2026-09-25T04:11:21Z", "published_at": "2026-09-25T04:11:21Z", "first_seen_at": "2026-09-25T09:43:54.635746Z", "time_precision": "published", "update_type": "escalation", "material_change": true, "title_zh": "Bitget黑客事件：3.516亿美元被盗，2026年最大规模入侵——shattered.io", "title_en": "Bitget Hack: $351.6M Stolen, Biggest Breach of 2026 - shattered.io", "what_changed_zh": "据报道，Bitget遭遇安全漏洞，3.516亿美元被盗，被称为2026年最大规模的加密货币交易所黑客事件。", "what_changed_en": "Bitget is reported to have suffered a security breach in which $351.6M was stolen, described as the largest crypto exchange hack of 2026.", "current_state_zh": "据报道，Bitget遭遇安全漏洞，3.516亿美元被盗，被称为2026年最大规模的加密货币交易所黑客事件。", "current_state_en": "Bitget is reported to have suffered a security breach in which $351.6M was stolen, described as the largest crypto exchange hack of 2026.", "detailed_summary_zh": "Bitget is reported to have suffered a security breach in which $351.6M was stolen, described as the largest crypto exchange hack of 2026.", "detailed_summary_en": "Bitget is reported to have suffered a security breach in which $351.6M was stolen, described as the largest crypto exchange hack of 2026.", "background_zh": "Bitget 于 2018 年在新加坡成立，早期业务以加密衍生品和跟单交易为主，此后扩展为更综合的交易平台。赵长鹏创立了按交易量计全球最大的加密货币交易所币安，并已卸任首席执行官；他在服完四个月刑期后于 2024 年 9 月获释。赵长鹏的公开表态在交易所行业内持续受到关注。", "background_en": "Bitget was founded in Singapore in 2018 and built its early business around crypto derivatives and copy trading before expanding into a broader trading platform. Changpeng Zhao founded Binance, the largest cryptocurrency exchange by trading volume, and stepped down as CEO; he was released from US custody in September 2024 after serving a four-month sentence. Public statements by CZ continue to draw attention across the exchange industry.", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "传导渠道是交易所风险与托管信心：Bitget 遭遇的 3.88 亿美元攻击使其用户和交易对面临提现中断与流动性压力的风险，同时让市场对整个中心化交易所安全性的关注度上升。影响主要集中在 Bitget 自身平台及其用户群，而非全系统性；报道本身无法推断任何具体资产的价格走向。", "market_impact_en": "The transmission channel is exchange risk and custody confidence: a $388 million breach at Bitget exposes its users and trading pairs to withdrawal disruptions and liquidity strain, while drawing fresh scrutiny to centralized exchange security broadly. The impact is concentrated on Bitget's own venue and user base rather than system-wide, and no specific asset price outcome can be inferred from the report.", "importance_score": 9.0, "references": [ { "url": "https://www.cnbc.com/2026/09/25/crypto-platform-bitget-suspects-north-korea-in-352-million-hack.html", "title": "Crypto platform Bitget suspects North Korea in $352 million hack" }, { "url": "https://en.wikipedia.org/wiki/Lazarus_Group", "title": "Lazarus Group - Wikipedia" }, { "url": "https://www.trmlabs.com/resources/blog/north-korea-stole-76-of-all-crypto-hack-value-in-2026-with-just-two-attacks", "title": "North Korea Stole 76% of All Crypto Hack Value in 2026 — With Just Two Attacks | TRM Labs" }, { "url": "https://en.wikipedia.org/wiki/Bitget", "title": "Bitget - Wikipedia" }, { "url": "https://en.wikipedia.org/wiki/Changpeng_Zhao", "title": "Changpeng Zhao - Wikipedia" }, { "url": "https://www.forbes.com/sites/digital-assets/article/what-is-bitget/", "title": "What Is Bitget? A Guide To This Cryptocurrency Exchange in March 2026" } ], "confidence": 0.75, "story_ids": [ "google_news:article:89ab9f7cb2d13f27", "google_news:article:3d33e3ed620ffab4", "google_news:article:c6afc62863eaa274", "google_news:article:f14f86265554c67d", "google_news:article:9cc189a82433747e", "google_news:article:a801527685cda78b", "google_news:article:82f1e804e3686b53", "google_news:article:e5cb2b553f864f17", "rss:cryptoslate.com_feed_:e00e17dcb1309d6a", "google_news:article:9cbb8bc3bc1d8e74", "rss:decrypt.co_feed:cddc6f0758f62d7f", "rss:bitcoinmagazine.com_.rss_full_:fbcd2f4d7ed70645", "rss:www.coindesk.com_arc_outboundfeeds_rss_:e80ee3c43bd7988c", "rss:www.coindesk.com_arc_outboundfeeds_rss_:fa1f60ca3aaecf67", "rss:thedefiant.io_api_feed:557e6ec8462c75a4", "rss:protos.com_feed_:5fd13745f96430af", "google_news:article:9ac905cb2038d80f", "google_news:article:262f10f3234c39fb", "google_news:article:6ad932b5ac521339", "rss:cryptoslate.com_feed_:c24c9475da654523", "rss:cointelegraph.com_rss:6b7fe47cd22aa387", "google_news:article:fad9284487081e04", "rss:cryptoslate.com_feed_:6f3398d1e55dae5a", "google_news:article:4316c124812c81b7", "rss:cointelegraph.com_rss:b0d5ed2476375a5b", "google_news:article:0d75dc8ccd650796", "google_news:article:f705ea62de42a519" ], "sources": [ { "url": "https://news.google.com/rss/articles/CBMiX0FVX3lxTE1mTzA3Y1VXT3FIQmZuLTlQMVJwWC1tWWpaVm1EM2pyQzdmUGZ3SlBpaWF3Vm9MVXhwT3h1WVdrLUk5Y2NwdEh3TXlISHB0cWVUNVNMQ2V6R01scHlXUmxB?oc=5", "label": "shattered.io", "source_type": "google_news", "official": false }, { "url": "https://news.google.com/rss/articles/CBMifEFVX3lxTFBqYnZUdkpmeXl5T3Q4aWdmcW1xZkJtYVotc1lWa2V3eXNPRThjdjlteFZrVEVEazNwREpkaVozRnFMaE5IeTA2N0NMT2stN0V2QVpqbjQ1VS1XWWF4Y1IwRWJCX1ZXU0JBUW8yUUQ2M2xSbG0wOGEwQnhFVUI?oc=5", "label": "The Cryptonomist", "source_type": "google_news", "official": false }, { "url": "https://news.google.com/rss/articles/CBMiigFBVV95cUxNUW5QZVQxVWFaWU1PTmxQVk9ZdjBXM3l5Y1hLMlJBUkZSU1UxWXBVWm5SZ00xcTJFRXFXcmxRWFF3MG9pT1g1WkU3cmdkX2g1VmZfZEhIUm1vV3JQRVFZWWdTMzhpVW9MaUJHOHRGOFEtMWlCRXJPV3lNaDJSdURyN1JvaUNfZEpIQXc?oc=5", "label": "Pluang", "source_type": "google_news", "official": false }, { "url": "https://news.google.com/rss/articles/CBMid0FVX3lxTE5sVTd5SEUxTS10d2hIMjlWbEM1emxSNFltdVBidi14T1JBeGdBaUxEdkFIbUUwY1lDaVFpMk9NUWNkRTZxaHNjTmdoUVBrNDRfZTZqS3R2SElCRDhLaTBoLU1na1hOSU9jTzdKc1FvdTB1UXRTbTFr?oc=5", "label": "Substack", "source_type": "google_news", "official": false }, { "url": "https://news.google.com/rss/articles/CBMixwFBVV95cUxOVkhabVNGM01QTmxOS0RjczZDSFlRSkdIc2h1QzBadi00WE82cU9GZ2NjS1FZLWVSenVPUGNENjFwNE1UQ0xQWjV4SkFqckZPSE8xLTVEamJVM01GczFRckFUamc5NnRFeW1hUFhoalJ0N0JyLVpvTmxEMzRXUTVZanc5SXNmSXlfUmo2RUZiSDJQSENjektvNFBURURhbVBBUUJzX193TkRnZ2FsQlVnWkZrdVJPQmhGSjRaRW5WNzBfajlWVEln?oc=5", "label": "TradingView", "source_type": "google_news", "official": false }, { "url": "https://news.google.com/rss/articles/CBMiogFBVV95cUxNOGpVUU4ydnk1VHcyaGxURWEzWVVBNGwxYlhod0gxalJ4UjBtTUtjdUU3SnJJdWFmd3NOVDVKSmV4bVhXSnNwX2RfNjc0ZzNVbzRWSVFEUGdVMDdTNlRHSjhpN0FycldkMXYxWFlzSFFLd2dtZXJDblczTW02cXktanNIREIzSzFYTFpCZEtSSVFsaHlYNE1oZ1dXRDZWeldfRHfSAacBQVVfeXFMUFBiU1hCOTRwM0RGUGN2aU5wUlpSRlZqVFhRRTZGZmswWV9palZseW1ZZWZFTjhPN25WMUtvc3NSYk1kaDA1QldUdGVURzNwd0xZMnhMd1JnamxFMXpndkJXNlk5VHJ2aEM0b2lJQjVNUm5EcS13UzJtWXNpZmoxZmZDNGwtdVlxZnNQSjhYSDZnY2ZoeXBuUFB5RWxtMFZ0QVBodkJXNE0?oc=5", "label": "CNBC", "source_type": "google_news", "official": false }, { "url": "https://news.google.com/rss/articles/CBMidEFVX3lxTE55ZS10SS1SWTZRQUNYTXM0UFI1V0VjMnAtcHc2RUthLXowRnQyUHZiWURHQ0dleFpRQmJYQVJQZ25wRDljVHpBVW12eTRRcEs5eFFOTlozeWw1Y1hFb3dZYjdlaFdsSEpLMmNNaFRhalBuYVV5?oc=5", "label": "Substack", "source_type": "google_news", "official": false }, { "url": "https://news.google.com/rss/articles/CBMijwFBVV95cUxOUWp4WWhqS1FuZVc4RU5iU0RQYVp4dnBNNHNxRy1zOEVfZEdTRXF4d19WU0F2Wmh1WXhQSHVScXZabnFpNXNhRW9hdW9RYUpGeDF0RUpDLVNDaUtPa29ENEo4Y3VqN1plWC1QM0dQdTdSc2FfWFkzNExCWk5aY1ZLZjJnY3FYSHVva28wMUxkQQ?oc=5", "label": "The Tech Buzz", "source_type": "google_news", "official": false }, { "url": "https://cryptoslate.com/bitgets-north-korea-linked-352-million-hack-could-drain-76-of-its-protection-fund/", "label": "CryptoSlate", "source_type": "rss", "official": false }, { "url": "https://news.google.com/rss/articles/CBMidEFVX3lxTE1EV3FrOF93aHlJWi1BVGlCdG5McmJNNVBSd08waEJmcVNjZ2RDOVd0LTBCa2M1VktsQnl6YTNzcDBKSGRSYk1hOVFUZzA2Rm1YdXdqSEU0cjIxZFdDZTlkZkVWTXBRWEd5S1hGb3l2Q19pdk15?oc=5", "label": "tech-insider.org", "source_type": "google_news", "official": false }, { "url": "https://decrypt.co/379350/bitget-hack-387m-what-happened-why-north-korea-suspect", "label": "Decrypt", "source_type": "rss", "official": false }, { "url": "https://bitcoinmagazine.com/news/north-korea-linked-to-bitget-hack", "label": "Bitcoin Magazine", "source_type": "rss", "official": false }, { "url": "https://www.coindesk.com/markets/2026/09/25/bitget-s-usd351-million-hack-happened-via-spoofed-transfers-not-private-keys-ceo-gray-chen-says", "label": "CoinDesk", "source_type": "rss", "official": false }, { "url": "https://www.coindesk.com/markets/2026/09/25/circle-and-tether-step-in-to-freeze-hacker-wallet-after-massive-bitget-crypto-heist", "label": "CoinDesk", "source_type": "rss", "official": false }, { "url": "https://thedefiant.io/news/hacks/bitget-raises-hack-estimate-to-387-5-million-as-token-accounting-widens", "label": "The Defiant", "source_type": "rss", "official": false }, { "url": "https://protos.com/bitgets-eighth-birthday-ends-with-a-352m-hack/", "label": "Protos", "source_type": "rss", "official": false }, { "url": "https://news.google.com/rss/articles/CBMiZEFVX3lxTE92RUFSckc4dU5iampCa1RndGdubTYxZ0h0ZjJfc2J2clRKcF9QNjZJZmYxLWFkOTFvZmhJMFVicVVEOG9KRHhYM3ZBdWdxdjMzbXNKUWJOOFJ5UTRsUC1yY1puQlo?oc=5", "label": "Binance", "source_type": "google_news", "official": false }, { "url": "https://news.google.com/rss/articles/CBMiW0FVX3lxTFBkZ3JPUnlfQ2FSMXpnWG5hMEZCNmZ3bDF2QmVYOXJSeFlSTDNiVk5McEVlQXU5M002ZWQwS1poZkkwRTZ0Uld2ZFJHWjlvbVBkMTFvNWdRN0NuSTQ?oc=5", "label": "tokenpost.com", "source_type": "google_news", "official": false }, { "url": "https://news.google.com/rss/articles/CBMifkFVX3lxTE9nTlhxSWJjY0lnd01pd2VBeHRFOWxZalBnV0VkY3JTMzRzX21LQ3pWNUxoYlpTYUUyN2J0ZWUzMTlKbnlMZkExZjJGTmRtUFEtRXRRaHlYa2llS25lV0pyLVNhaFFUYUVIOG9MT1ViZk4wVGxpa1k1dnIyWDhwZw?oc=5", "label": "Coinfomania", "source_type": "google_news", "official": false }, { "url": "https://cryptoslate.com/bitgets-hack-just-got-36-million-bigger-and-now-theres-a-bounty-on-the-stolen-crypto/", "label": "CryptoSlate", "source_type": "rss", "official": false }, { "url": "https://cointelegraph.com/news/bitget-clarifies-assets-affected-security-breach?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound", "label": "Cointelegraph", "source_type": "rss", "official": false }, { "url": "https://news.google.com/rss/articles/CBMipAFBVV95cUxObjZlUzRua2tjVXczTHVlNU9FUXNiaXRRRmJTN0ZTdjJqdmMtYlp4Nlo4c2o4TDVHVUpONUVqUXFLZzlVMTBXS29DNElZU251bk5ySDQ5dE0tV0t0UmFLblMzUm1KR1NpYy1pTmRIWkJyR2EwdW1mXzJEZllVallFa0JNZ25tWWdXREJzZkFIdE5wWVlGU0RHWmpSaWY3d2t0b0ZEVw?oc=5", "label": "Pluang", "source_type": "google_news", "official": false }, { "url": "https://cryptoslate.com/swiss-bank-shields-bitget-institutions-while-retail-funds-freeze/", "label": "CryptoSlate", "source_type": "rss", "official": false }, { "url": "https://news.google.com/rss/articles/CBMitwFBVV95cUxNdWlDYmVHOEJ5NTMtT1ZldlZRUElXdXl0Y0JadkVXVG5LNk1iYnE2OTBaNW1rNHRxSkFpa3RUelRsNnJHdHFwWkxUeU4yaWVnallHM21OR2tobWYtS2hoZmczTWtzUENTSnQzeGRWNExlUnNiQ3VDX1piS0IwWDZ0Y21VTU1RM3NwaUJVM0J6RVFubmd2N0xzWHlCSXUtZzNSMV9kMmJPTm1JaElHZzdnRlliMlVQTUU?oc=5", "label": "The American Bazaar", "source_type": "google_news", "official": false }, { "url": "https://cointelegraph.com/news/bitget-btc-withdrawal-hacker-eth-swap-thorchain?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound", "label": "Cointelegraph", "source_type": "rss", "official": false }, { "url": "https://news.google.com/rss/articles/CBMiggFBVV95cUxPSGpMNWdMWUFzVUUwZmFad0JqMFRhdERZcy1KdzR1WkZLb0NVM3RxazdpeTlaenlKaVhGYUY0VHdsSkg0dllBRE5EUzVnLTl5OXhRSFVXcUpTZHBySmdyNE9sMGs4QTgxNElkZlZzWkhFMzl1ckhYbklaeF9WU3ByeWt3?oc=5", "label": "Hokanews", "source_type": "google_news", "official": false }, { "url": "https://news.google.com/rss/articles/CBMi4wFBVV95cUxQN0hkdEZsSHd5QUg2UlYwbERYdWNVc1ZwVk5iUnBfYjY4Y3lzR0ozY2ZKNlhSTm5BTXRCYVo5UFZHX3hZbWpxWVFhRkFWVVVjYWE0bTNKYjBRdEtOMEFnajFRbUNxNktTTm05S21KQzUzajdMdUlDTjNpTFpySlVxNTFHMGN2ODd1dElSX0x3WklJaDVFZjFhNjd5VWJPaElVZTgxVnhCRzZWb210a3ZXc3NkbWY0TlJLZ3N4MTYzU3V3TjdhU0syRkxkeWxxSlh5SFNDUmx2WjhEWDJDUUNUN19xbw?oc=5", "label": "24/7 Wall St.", "source_type": "google_news", "official": false } ] }, { "update_id": "upd_ae4fb24936bbb9c7", "event_id": "evt_6655595dc1e36e0b", "occurred_at": "2026-09-25T11:28:43Z", "published_at": "2026-09-25T11:28:43Z", "first_seen_at": "2026-09-25T17:25:10.222324Z", "time_precision": "published", "update_type": "escalation", "material_change": true, "title_zh": "3.51亿美元不翼而飞……黑客已在转移资金！- Binance", "title_en": "$351M GONE… AND THE HACKER IS ALREADY SWAPPING IT! - Binance", "what_changed_zh": "据报道，一起黑客攻击导致3.51亿美元被盗，攻击者已在转移被盗资金。", "what_changed_en": "$351M has reportedly been stolen in a hack, and the attacker is already swapping the stolen funds.", "current_state_zh": "据报道，一起黑客攻击导致3.51亿美元被盗，攻击者已在转移被盗资金。", "current_state_en": "$351M has reportedly been stolen in a hack, and the attacker is already swapping the stolen funds.", "detailed_summary_zh": "$351M has reportedly been stolen in a hack, and the attacker is already swapping the stolen funds.", "detailed_summary_en": "$351M has reportedly been stolen in a hack, and the attacker is already swapping the stolen funds.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.0, "references": [], "confidence": 0.75, "story_ids": [ "google_news:article:92a7ffb368c7b35f" ], "sources": [ { "url": "https://news.google.com/rss/articles/CBMiaEFVX3lxTE5wN1MxWnBQOUZwOU9IcDdZZS1mVGYyMUc5SzRCY0dqRDhkUnFxUjNYYWh0X2lMeGU2ZFVPRjhWcWhRUTVaZ2JxY1ZSLWdnRS1SamVwUUswMkRZa2tuc3B3ZWxMN00xTnpf?oc=5", "label": "Binance", "source_type": "google_news", "official": false } ] }, { "update_id": "upd_f3386a920595f5a0", "event_id": "evt_6655595dc1e36e0b", "occurred_at": "2026-09-25T18:42:51Z", "published_at": "2026-09-25T18:42:51Z", "first_seen_at": "2026-09-25T23:24:24.062734Z", "time_precision": "published", "update_type": "response", "material_change": true, "title_zh": "Circle与Tether冻结与Bitget黑客事件相关的稳定币——但大部分资金已溜走", "title_en": "Circle and Tether Freeze Stablecoins Tied to Bitget Hack—But Most Funds Slip Away", "what_changed_zh": "Circle与Tether冻结了与Bitget约3.87亿美元黑客事件相关的约31.8万美元USDC和USDT，而攻击者的约170枚ETH及其他攻击者持有的ETH仍处于发行方无法触及的范围之外。", "what_changed_en": "Circle and Tether froze roughly $318,000 in USDC and USDT tied to the ~$387 million Bitget hack, while the attacker's ~170 ETH and other exploiter-held ETH remained beyond the issuers' reach.", "current_state_zh": "Circle与Tether冻结了与Bitget约3.87亿美元黑客事件相关的约31.8万美元USDC和USDT，而攻击者的约170枚ETH及其他攻击者持有的ETH仍处于发行方无法触及的范围之外。", "current_state_en": "Circle and Tether froze roughly $318,000 in USDC and USDT tied to the ~$387 million Bitget hack, while the attacker's ~170 ETH and other exploiter-held ETH remained beyond the issuers' reach.", "detailed_summary_zh": "Circle and Tether froze roughly $318,000 in USDC and USDT tied to the ~$387 million Bitget hack, while the attacker's ~170 ETH and other exploiter-held ETH remained beyond the issuers' reach.", "detailed_summary_en": "Circle and Tether froze roughly $318,000 in USDC and USDT tied to the ~$387 million Bitget hack, while the attacker's ~170 ETH and other exploiter-held ETH remained beyond the issuers' reach.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.5, "references": [], "confidence": 0.75, "story_ids": [ "rss:decrypt.co_feed:a4071d1f0881e3d5" ], "sources": [ { "url": "https://decrypt.co/379365/circle-tether-freeze-stablecoins-bitget-hack", "label": "Decrypt", "source_type": "rss", "official": false } ] }, { "update_id": "upd_62c36e9024283ea2", "event_id": "evt_6655595dc1e36e0b", "occurred_at": "2026-09-26T12:56:41Z", "published_at": "2026-09-26T12:56:41Z", "first_seen_at": "2026-09-26T16:34:44.876459Z", "time_precision": "published", "update_type": "escalation", "material_change": true, "title_zh": "Bitget黑客转移8300万美元被盗XRP，Ripple无法冻结", "title_en": "Bitget hacker moves $83 million in stolen XRP that Ripple cannot freeze", "what_changed_zh": "Bitget 3.875亿美元漏洞背后的攻击者从三个持有钱包中转移了约8300万美元被盗XRP，剩余约7500万美元留在根据XRP Ledger规则无法冻结的账户中，而Bitget表示其保护基金覆盖损失，分阶段提现将从9月28日持续至10月2日恢复。", "what_changed_en": "The attacker behind Bitget's $387.5M breach drained about $83M of stolen XRP from three holding wallets, leaving roughly $75M in accounts that cannot be frozen under the XRP Ledger's rules, while Bitget said its protection fund covers losses and staged withdrawals resume Sept. 28 through Oct. 2.", "current_state_zh": "Bitget 3.875亿美元漏洞背后的攻击者从三个持有钱包中转移了约8300万美元被盗XRP，剩余约7500万美元留在根据XRP Ledger规则无法冻结的账户中，而Bitget表示其保护基金覆盖损失，分阶段提现将从9月28日持续至10月2日恢复。", "current_state_en": "The attacker behind Bitget's $387.5M breach drained about $83M of stolen XRP from three holding wallets, leaving roughly $75M in accounts that cannot be frozen under the XRP Ledger's rules, while Bitget said its protection fund covers losses and staged withdrawals resume Sept. 28 through Oct. 2.", "detailed_summary_zh": "The attacker behind Bitget's $387.5M breach drained about $83M of stolen XRP from three holding wallets, leaving roughly $75M in accounts that cannot be frozen under the XRP Ledger's rules, while Bitget said its protection fund covers losses and staged withdrawals resume Sept. 28 through Oct. 2.", "detailed_summary_en": "The attacker behind Bitget's $387.5M breach drained about $83M of stolen XRP from three holding wallets, leaving roughly $75M in accounts that cannot be frozen under the XRP Ledger's rules, while Bitget said its protection fund covers losses and staged withdrawals resume Sept. 28 through Oct. 2.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.0, "references": [], "confidence": 0.75, "story_ids": [ "rss:www.coindesk.com_arc_outboundfeeds_rss_:43235257dbaa4f57" ], "sources": [ { "url": "https://www.coindesk.com/markets/2026/09/26/bitget-hacker-moves-usd83-million-in-stolen-xrp-that-ripple-cannot-freeze", "label": "CoinDesk", "source_type": "rss", "official": false } ] }, { "update_id": "upd_8236e70da1deffc8", "event_id": "evt_6655595dc1e36e0b", "occurred_at": "2026-09-27T02:01:44Z", "published_at": "2026-09-27T02:01:44Z", "first_seen_at": "2026-09-27T10:07:41.220228Z", "time_precision": "published", "update_type": "response", "material_change": true, "title_zh": "THORChain在漏洞事件余波中拒绝封锁Bitget地址的请求 - Intellectia AI", "title_en": "THORChain Rejects Request to Block Bitget Addresses Amid Exploit Fallout - Intellectia AI", "what_changed_zh": "THORChain在漏洞事件后拒绝了封锁Bitget相关地址的请求，该网络的决定凸显了其拒绝应交易所或第三方要求审查交易的立场。", "what_changed_en": "THORChain rejected a request to block Bitget-related addresses in the wake of an exploit, with the network's decision highlighting its refusal to censor transactions at the request of an exchange or third party.", "current_state_zh": "THORChain在漏洞事件后拒绝了封锁Bitget相关地址的请求，该网络的决定凸显了其拒绝应交易所或第三方要求审查交易的立场。", "current_state_en": "THORChain rejected a request to block Bitget-related addresses in the wake of an exploit, with the network's decision highlighting its refusal to censor transactions at the request of an exchange or third party.", "detailed_summary_zh": "THORChain rejected a request to block Bitget-related addresses in the wake of an exploit, with the network's decision highlighting its refusal to censor transactions at the request of an exchange or third party.", "detailed_summary_en": "THORChain rejected a request to block Bitget-related addresses in the wake of an exploit, with the network's decision highlighting its refusal to censor transactions at the request of an exchange or third party.", "background_zh": "THORChain 是一个去中心化跨链流动性协议，允许在不同区块链之间直接兑换数字资产，无需依赖中心化交易所。其官方 FAQ 称，该协议没有中心化治理机构或 DAO，协议升级由开发者社区提出并协调，节点参与其中。Bitget 成立于 2018 年，是一家中心化加密货币交易所。", "background_en": "THORChain is a decentralized cross-chain liquidity protocol that enables swaps of digital assets across different blockchains without relying on centralized exchanges. According to its FAQ, it has no central governance body or DAO, with protocol upgrades proposed and coordinated by the developer community and node operators. Bitget, founded in 2018, is a centralized cryptocurrency exchange.", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "最直接的敞口是 THORChain 的原生代币 RUNE 及其跨链兑换活动，因为拒绝配合交易所的冻结请求可能影响中心化交易所及其用户通过此类渠道转移资金的方式。该争议也会使 THORChain 上的 XRP 与 BTC 交易对受到更多关注，但这属于治理与合规层面的问题，而非全市场性事件。", "market_impact_en": "The most direct exposure is THORChain’s RUNE token and its cross-chain swap activity, since a refusal to honor exchange freeze requests can affect how centralized exchanges and their users route funds through such venues. The dispute also draws scrutiny to XRP and BTC pairs on THORChain, though it is a governance and compliance question rather than a market-wide event.", "importance_score": 7.5, "references": [ { "url": "https://thorchain.org/faq", "title": "THORChain FAQ | Answers About Swaps, RUNE, TCY & How..." }, { "url": "https://en.wikipedia.org/wiki/Bitget", "title": "Bitget - Wikipedia" }, { "url": "https://thorchain.org/", "title": "THORChain" } ], "confidence": 0.75, "story_ids": [ "google_news:article:c0c03f97c613eba8", "google_news:article:672982a9a96fc5c8", "rss:thedefiant.io_api_feed:8f434300f2842773" ], "sources": [ { "url": "https://news.google.com/rss/articles/CBMiqwFBVV95cUxQLW43Ykg5azBxRjRMRHl0Snd4bjZ2ZWhQZ3Q1OUkwdkt6RlpZTlkyel9rUzJPckhVVzdMNzF5SkZlaXlBb3A2ZVNxcl9icjhOb054SW10ZUxTTnBNdXRLeGJ2cl9xamEzbHh5YmxYYVJSeEx6ZEpEZW92aEhoQ04yZ2pDZnhiX1pFdDM4N0Z1cFF2NW5LaC13MDJvQ1FZcGJhY3hJVWVsSEFnUHc?oc=5", "label": "Intellectia AI", "source_type": "google_news", "official": false }, { "url": "https://news.google.com/rss/articles/CBMickFVX3lxTE1tSmN1OTZFcXN5UGhUQ2p0WXotckFzQXdPODB5VWdGbWtJM1NxdTNHU05BSjNYNkdsOUQ1a3BJeFRmckRXOFpjQmNYaEx1RUhsLVpxVzJ4ZGdlSDZjaW9HSURuQ1VhbDdLOXhJcW81QUtNUQ?oc=5", "label": "BeInCrypto", "source_type": "google_news", "official": false }, { "url": "https://thedefiant.io/news/defi/thorchain-pushes-back-on-bitget-s-demand-to-block-hacker-addresses", "label": "The Defiant", "source_type": "rss", "official": false } ] }, { "update_id": "upd_fa0e89935cbeab68", "event_id": "evt_6655595dc1e36e0b", "occurred_at": "2026-09-27T17:00:42Z", "published_at": "2026-09-27T17:00:42Z", "first_seen_at": "2026-09-27T17:08:08.125264Z", "time_precision": "published", "update_type": "escalation", "material_change": true, "title_zh": "2700万枚被盗代币转移之际，Bitget冻结XRP提现", "title_en": "Bitget freezes XRP withdrawals as 27M stolen tokens move", "what_changed_zh": "截至9月26日，Bitget的XRP提现通道仍处于关闭状态，按交易所公布的漏洞事件后提现恢复时间表，XRP被归入10月2日08:00 UTC的最后一批。Bitquery表示，截至9月26日02:54 UTC，已有2763万枚被盗XRP从两个被追踪的攻击者账户转出，其追踪的六个账户中仍留有7535万枚XRP。\n\n对Bitget上的XRP持有者而言，交易仍可进行，但在10月2日的计划阶段开放前，无法将XRP提至外部XRP Ledger地址。被盗代币的持续转移则关系到赃款是否正在被进一步分散。\n\nBitget的提现恢复分阶段进行：9月28日为BTC，9月29日为ETH，9月30日为USDT，10月2日则覆盖“其他代币”、法币及点对点服务；XRP未被单独列出。该交易所表示已查明并修复了9月24日事件涉及的漏洞，用户余额未受影响，交易和充值仍在继续。", "what_changed_en": "Bitget left XRP withdrawals disabled as it scheduled its final post-breach withdrawal reopening phase for Oct. 2, while Bitquery traced 27.63 million stolen XRP moving onward from two tracked accounts.", "current_state_zh": "截至9月26日，Bitget的XRP提现通道仍处于关闭状态，按交易所公布的漏洞事件后提现恢复时间表，XRP被归入10月2日08:00 UTC的最后一批。Bitquery表示，截至9月26日02:54 UTC，已有2763万枚被盗XRP从两个被追踪的攻击者账户转出，其追踪的六个账户中仍留有7535万枚XRP。\n\n对Bitget上的XRP持有者而言，交易仍可进行，但在10月2日的计划阶段开放前，无法将XRP提至外部XRP Ledger地址。被盗代币的持续转移则关系到赃款是否正在被进一步分散。\n\nBitget的提现恢复分阶段进行：9月28日为BTC，9月29日为ETH，9月30日为USDT，10月2日则覆盖“其他代币”、法币及点对点服务；XRP未被单独列出。该交易所表示已查明并修复了9月24日事件涉及的漏洞，用户余额未受影响，交易和充值仍在继续。", "current_state_en": "Bitget left XRP withdrawals disabled as it scheduled its final post-breach withdrawal reopening phase for Oct. 2, while Bitquery traced 27.63 million stolen XRP moving onward from two tracked accounts.", "detailed_summary_zh": "Bitget left XRP withdrawals disabled as it scheduled its final post-breach withdrawal reopening phase for Oct. 2, while Bitquery traced 27.63 million stolen XRP moving onward from two tracked accounts.", "detailed_summary_en": "Bitget left XRP withdrawals disabled as it scheduled its final post-breach withdrawal reopening phase for Oct. 2, while Bitquery traced 27.63 million stolen XRP moving onward from two tracked accounts.", "background_zh": "该事件发生在9月24日，未经授权的转账波及Bitget的热钱包和温钱包基础设施；Bitget称损失约3.516亿美元，另有报道称此次入侵涉及3.875亿美元。Bitquery估算从该交易所被盗的XRP约为1.0298亿枚，相关报道指出原生XRP无法在XRP Ledger协议层面被冻结，这限制了追回手段。Bitquery追踪到外流的XRP经由新账户流向跨链兑换网络THORChain，并称其能追踪到的资金大部分被兑换为比特币。", "background_en": "The incident dates to Sept. 24, when unauthorized transfers affected Bitget's hot and warm wallet infrastructure; Bitget has described the loss as approximately $351.6 million, while other reports put the breach at $387.5 million. Bitquery estimates about 102.98 million XRP was taken from the exchange, and reporting notes that native XRP cannot be frozen at the XRP Ledger protocol level, limiting recovery options. Bitquery followed outgoing XRP through new accounts toward the cross-chain swap network THORChain, saying most of the flow it could follow was being swapped toward Bitcoin.", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "在Bitget上，XRP仍可交易，但无法提至外部XRP Ledger地址，因此持有者将XRP转出该平台的能力取决于交易所的恢复时间表。Bitquery的追踪显示，被盗XRP经由THORChain流转并大部分被兑换为比特币，这是一条跨链流动性通道；但该追踪并不能证明发生了XRP现货抛售，因此并不直接反映订单簿层面的抛压。", "market_impact_en": "On Bitget, XRP can still be traded but not withdrawn to external XRP Ledger addresses, so holders' ability to move XRP off the venue is tied to the exchange's reopening timetable. Bitquery's tracing shows stolen XRP routed through THORChain and largely swapped toward Bitcoin — a cross-chain liquidity channel — but the trace does not establish spot XRP sales, so it is not a direct measure of order-book pressure.", "importance_score": 7.5, "references": [ { "url": "https://www.coindesk.com/markets/2026/09/26/bitget-hacker-moves-usd83-million-in-stolen-xrp-that-ripple-cannot-freeze", "title": "Bitget hacker moves $83 million in stolen XRP that Ripple cannot freeze" }, { "url": "https://financefeeds.com/bitget-hacker-moves-83m-in-xrp-as-network-rules-limit-recovery/", "title": "Bitget Hacker Moves $83M of Stolen XRP; $75M Still Parked" }, { "url": "https://www.ccn.com/news/crypto/bitget-hack-xrp-eth-351-million-withdrawals/", "title": "XRP and ETH Lead $351.6M Bitget Wallet Breach as Withdrawals Remain Paused" } ], "confidence": 0.75, "story_ids": [ "rss:cryptoslate.com_feed_:d018c92454693b96" ], "sources": [ { "url": "https://cryptoslate.com/bitget-freezes-xrp-withdrawals-as-27m-stolen-tokens-move/", "label": "CryptoSlate", "source_type": "rss", "official": false } ] }, { "update_id": "upd_f5b864a3c22ed76d", "event_id": "evt_6655595dc1e36e0b", "occurred_at": "2026-09-27T18:15:00Z", "published_at": "2026-09-27T18:15:00Z", "first_seen_at": "2026-09-28T01:56:44.154962Z", "time_precision": "published", "update_type": "escalation", "material_change": true, "title_zh": "GoPlus质疑THORChain的去中心化说法，此前Bitget黑客事件中约8000万美元XRP发生转移 - finance.biggo.com", "title_en": "GoPlus Challenges THORChain's Decentralization Claims Amid $80 Million XRP Movement From Bitget Hack - finance.biggo.com", "what_changed_zh": "GoPlus在追踪与Bitget黑客事件相关的约8000万美元XRP时，对THORChain的去中心化说法提出质疑。", "what_changed_en": "GoPlus pushed back on THORChain's decentralization claims while tracing about $80 million in XRP tied to the Bitget hack.", "current_state_zh": "GoPlus在追踪与Bitget黑客事件相关的约8000万美元XRP时，对THORChain的去中心化说法提出质疑。", "current_state_en": "GoPlus pushed back on THORChain's decentralization claims while tracing about $80 million in XRP tied to the Bitget hack.", "detailed_summary_zh": "GoPlus pushed back on THORChain's decentralization claims while tracing about $80 million in XRP tied to the Bitget hack.", "detailed_summary_en": "GoPlus pushed back on THORChain's decentralization claims while tracing about $80 million in XRP tied to the Bitget hack.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 7.0, "references": [], "confidence": 0.75, "story_ids": [ "google_news:article:395305eed7229529" ], "sources": [ { "url": "https://news.google.com/rss/articles/CBMidkFVX3lxTE9XeHg3N1VkQzE3SDVRakZhS0JFVTRnX1lyX3RnQVZYellwalE5X19Raml5dF9FS0xxZ1hIOFpZSG9fS0NnRlRXOW0xdWNmR0RGZXpuZ0JIVlNPb2RFbEVSTmNNY1lTLWZRMWdkVmlSYjZMQzdWT0E?oc=5", "label": "finance.biggo.com", "source_type": "google_news", "official": false } ] }, { "update_id": "upd_95bb1ef694726420", "event_id": "evt_6655595dc1e36e0b", "occurred_at": "2026-09-28T01:48:02Z", "published_at": "2026-09-28T01:48:02Z", "first_seen_at": "2026-09-28T11:07:58.977712Z", "time_precision": "published", "update_type": "remediation", "material_change": true, "title_zh": "加密早报：Upbit L2项目GIWA发布官方澄清，Bitget将逐步恢复提现", "title_en": "Crypto Morning Brief: Upbit L2 Project GIWA Issues Official Clarification, Bitget to Gradually Resume Withdrawals", "what_changed_zh": "据加密早报，Upbit的L2项目GIWA发布官方澄清，Bitget宣布将逐步恢复提现。", "what_changed_en": "Upbit's L2 project GIWA issued an official clarification and Bitget announced it will gradually resume withdrawals, according to a crypto morning brief.", "current_state_zh": "据加密早报，Upbit的L2项目GIWA发布官方澄清，Bitget宣布将逐步恢复提现。", "current_state_en": "Upbit's L2 project GIWA issued an official clarification and Bitget announced it will gradually resume withdrawals, according to a crypto morning brief.", "detailed_summary_zh": "Upbit's L2 project GIWA issued an official clarification and Bitget announced it will gradually resume withdrawals, according to a crypto morning brief.", "detailed_summary_en": "Upbit's L2 project GIWA issued an official clarification and Bitget announced it will gradually resume withdrawals, according to a crypto morning brief.", "background_zh": "Bitget 在一起约3.5亿美元加密货币被盗的黑客事件后冻结了客户提现；首席执行官 Gracy Chen 表示冷钱包完全安全，受影响的只有热钱包。交易所随后称，此次事件涉及其钱包基础设施中的关键后端系统，攻击者利用第三方产品的漏洞获取内部凭证，并用其提交绕过风控的欺诈性提现指令，相关漏洞已在恢复提现前修复。链上调查员 ZachXBT 表示，中国非法行为者正代其称为疑似与朝鲜有关的黑客清洗赃款，通过跨链转移把资金存入包括 Wasabi 在内的混币服务；这一活动使 THORChain 卷入争议——当赃款流经其系统时，无需许可的基础设施是否应当介入，而 THORChain 表示不会选择性地封锁钱包或 swap。", "background_en": "Bitget froze customer withdrawals after a hack in which roughly $350 million in crypto was stolen; CEO Gracy Chen said cold wallets remained fully secure and that only hot wallets were affected. The exchange has since said the incident involved a critical backend system in its wallet infrastructure, that attackers exploited vulnerabilities in third-party products to obtain internal credentials used to submit fraudulent withdrawal instructions, and that it remediated the vulnerability before withdrawals returned. Blockchain investigator ZachXBT said Chinese illicit actors were laundering proceeds on behalf of hackers he described as allegedly linked to North Korea, chain-hopping funds into mixing services including Wasabi; the activity has put THORChain at the center of a dispute over whether permissionless infrastructure should intervene when stolen assets pass through its systems, with THORChain saying it will not selectively block wallets or swaps.", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "约4642枚被追踪的交易所持仓比特币流出单一平台，会收紧该平台上 BTC 的现货流动性，并在交易者关注是否出现更多提现或风险外溢时，成为其他中心化交易所资产信心的可见信号。跨链桥、混币服务和 THORChain 构成的清洗路径，也持续给处理这些资金的协议与中介带来追回与合规压力；Bitget 则表示客户不会承担损失，其保护基金将覆盖缺口，并计划在一周内以自有资金将其补充至3亿美元以上。", "market_impact_en": "Roughly 4,642 BTC of tracked exchange-held bitcoin leaving a single venue tightens on-venue spot liquidity for BTC and is a visible confidence signal for other centralized-exchange assets as traders watch for further withdrawals or contagion. The laundering chain — bridges, mixers and THORChain — keeps recovery and compliance pressure on the protocols and intermediaries handling those flows, even as Bitget says user losses will be covered by its Protection Fund, which it plans to replenish above $300 million within a week.", "importance_score": 9.0, "references": [ { "url": "https://www.reuters.com/legal/government/crypto-exchange-bitget-pauses-withdrawals-after-350-million-stolen-hack-2026-09-25/", "title": "Crypto exchange Bitget pauses withdrawals after $350 million ..." }, { "url": "https://decrypt.co/379275/bitget-hack-183-million-crypto-exchange-wallets", "title": "Bitget Hacked as $350 Million Vanishes From Crypto Exchange ..." }, { "url": "https://defillama.com/cexs", "title": "Crypto Exchange Reserves and Inflows - DefiLlama" } ], "confidence": 0.75, "story_ids": [ "google_news:article:3d9255dfbcc29458", "rss:thedefiant.io_api_feed:3fe49d78f4a9ca18", "rss:cryptoslate.com_feed_:60dbbab8f61b8b35", "rss:cryptoslate.com_feed_:315e3f6485e3c68f" ], "sources": [ { "url": "https://www.techflowpost.com/en-US/article/34252", "label": "深潮TechFlow", "source_type": "google_news", "official": false }, { "url": "https://thedefiant.io/news/hacks/bitget-reopens-bitcoin-withdrawals-after-387-5-million-breach", "label": "The Defiant", "source_type": "rss", "official": false }, { "url": "https://cryptoslate.com/bitget-says-bitcoin-withdrawals-open-after-hack/", "label": "CryptoSlate", "source_type": "rss", "official": false }, { "url": "https://cryptoslate.com/nearly-5000-btc-leaves-bitget-as-hackers-begin-laundering-387-million-haul/", "label": "CryptoSlate", "source_type": "rss", "official": false } ] }, { "update_id": "upd_b2414fea77f7cf6c", "event_id": "evt_6655595dc1e36e0b", "occurred_at": "2026-09-28T12:13:09Z", "published_at": "2026-09-28T12:13:09Z", "first_seen_at": "2026-09-28T19:47:05.163343Z", "time_precision": "published", "update_type": "confirmation", "material_change": true, "title_zh": "THORChain拒绝Bitget封锁黑客的请求，600万美元转移至比特币", "title_en": "THORChain rejects Bitget request to block hacker as $6 million moves to bitcoin", "what_changed_zh": "THORChain拒绝了Bitget提出的将与该交易所3.875亿美元黑客攻击相关地址列入黑名单的请求，尽管CoinDesk追踪到27笔兑换通过该协议将约2390枚ETH（630万美元）转换为75.2枚BTC。", "what_changed_en": "THORChain refused Bitget's request to blacklist addresses tied to the exchange's $387.5M hack, even as CoinDesk traced 27 swaps moving ~2,390 ETH ($6.3M) into 75.2 BTC via the protocol.", "current_state_zh": "THORChain拒绝了Bitget提出的将与该交易所3.875亿美元黑客攻击相关地址列入黑名单的请求，尽管CoinDesk追踪到27笔兑换通过该协议将约2390枚ETH（630万美元）转换为75.2枚BTC。", "current_state_en": "THORChain refused Bitget's request to blacklist addresses tied to the exchange's $387.5M hack, even as CoinDesk traced 27 swaps moving ~2,390 ETH ($6.3M) into 75.2 BTC via the protocol.", "detailed_summary_zh": "THORChain refused Bitget's request to blacklist addresses tied to the exchange's $387.5M hack, even as CoinDesk traced 27 swaps moving ~2,390 ETH ($6.3M) into 75.2 BTC via the protocol.", "detailed_summary_en": "THORChain refused Bitget's request to blacklist addresses tied to the exchange's $387.5M hack, even as CoinDesk traced 27 swaps moving ~2,390 ETH ($6.3M) into 75.2 BTC via the protocol.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 7.5, "references": [], "confidence": 0.75, "story_ids": [ "rss:www.coindesk.com_arc_outboundfeeds_rss_:e18f748a1fe52ceb", "rss:protos.com_feed_:40ad62559997a9eb" ], "sources": [ { "url": "https://www.coindesk.com/tech/2026/09/28/thorchain-rejects-bitget-request-to-block-hacker-as-usd6-million-moves-to-bitcoin", "label": "CoinDesk", "source_type": "rss", "official": false }, { "url": "https://protos.com/thorchain-refuses-to-block-bitget-funds-despite-pausing-after-own-hack/", "label": "Protos", "source_type": "rss", "official": false } ] }, { "update_id": "upd_d91100ebc4f092e1", "event_id": "evt_6655595dc1e36e0b", "occurred_at": "2026-09-28T14:30:12Z", "published_at": "2026-09-28T14:30:12Z", "first_seen_at": "2026-09-28T19:47:18.046337Z", "time_precision": "published", "update_type": "confirmation", "material_change": true, "title_zh": "Bitget只有30分钟来遏制黑客事件，随后2.9亿美元开始转移", "title_en": "Bitget had 30 minutes to contain its hack before $290 million started moving", "what_changed_zh": "Bitget在攻击者从其热钱包转走8760万美元、随后又转走2.028亿美元之前约30分钟检测到未经授权的钱包转账，这意味着3.875亿美元损失中的大部分发生在交易所应急协议触发之后，并引发了对为何被攻破的签名路径仍保持活跃的质疑。", "what_changed_en": "Bitget detected unauthorized wallet transfers about 30 minutes before attackers drained $87.6 million and then $202.8 million from its hot wallets, meaning most of the $387.5 million loss occurred after the exchange's emergency protocols were triggered and raising questions about why the compromised signing route stayed live.", "current_state_zh": "Bitget在攻击者从其热钱包转走8760万美元、随后又转走2.028亿美元之前约30分钟检测到未经授权的钱包转账，这意味着3.875亿美元损失中的大部分发生在交易所应急协议触发之后，并引发了对为何被攻破的签名路径仍保持活跃的质疑。", "current_state_en": "Bitget detected unauthorized wallet transfers about 30 minutes before attackers drained $87.6 million and then $202.8 million from its hot wallets, meaning most of the $387.5 million loss occurred after the exchange's emergency protocols were triggered and raising questions about why the compromised signing route stayed live.", "detailed_summary_zh": "Bitget detected unauthorized wallet transfers about 30 minutes before attackers drained $87.6 million and then $202.8 million from its hot wallets, meaning most of the $387.5 million loss occurred after the exchange's emergency protocols were triggered and raising questions about why the compromised signing route stayed live.", "detailed_summary_en": "Bitget detected unauthorized wallet transfers about 30 minutes before attackers drained $87.6 million and then $202.8 million from its hot wallets, meaning most of the $387.5 million loss occurred after the exchange's emergency protocols were triggered and raising questions about why the compromised signing route stayed live.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.5, "references": [], "confidence": 0.75, "story_ids": [ "rss:cryptoslate.com_feed_:eb380e833fd1410e", "rss:cointelegraph.com_rss:2215a3db81677389" ], "sources": [ { "url": "https://cryptoslate.com/bitget-had-30-minutes-to-contain-its-hack-before-290-million-started-moving/", "label": "CryptoSlate", "source_type": "rss", "official": false }, { "url": "https://cointelegraph.com/news/bitget-388m-hack-third-party-security-vulnerability?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound", "label": "Cointelegraph", "source_type": "rss", "official": false } ] }, { "update_id": "upd_c84471279056a4a6", "event_id": "evt_6655595dc1e36e0b", "occurred_at": "2026-09-29T01:17:49Z", "published_at": "2026-09-29T01:17:49Z", "first_seen_at": "2026-09-29T02:42:26.013713Z", "time_precision": "published", "update_type": "response", "material_change": true, "title_zh": "NEAR Intents称其拦截了与Bitget黑客相关的5000万美元", "title_en": "NEAR Intents says it blocked $50M tied to Bitget hackers", "what_changed_zh": "NEAR Intents 的 SHIELD 系统拦截了超过 5000 万美元与 Bitget 黑客相关的转账尝试，并在执行中冻结了 503,000 美元，约 166,000 美元资金流经；NEAR Intents 表示将放弃 Bitget 提供的赏金。", "what_changed_en": "NEAR Intents' SHIELD system blocked over $50 million in attempted transfers tied to the Bitget hackers, freezing $503,000 mid-execution while about $166,000 passed through; NEAR Intents said it will forego Bitget's bounty.", "current_state_zh": "Circle 和 Tether 冻结了约 318,000 美元与 Bitget 黑客相关的 USDC/USDT；NEAR Intents 的 SHIELD 系统拦截了超过 5000 万美元相关转账并冻结 503,000 美元，约 166,000 美元流经；攻击者持有的 ETH 仍超出部分发行方控制。", "current_state_en": "Circle and Tether froze roughly $318,000 in USDC/USDT tied to the Bitget hack; NEAR Intents' SHIELD system blocked over $50 million in related transfers and froze $503,000, with about $166,000 passing through; attacker-held ETH remained beyond some issuers' reach.", "detailed_summary_zh": "NEAR Intents said its SHIELD system blocked more than $50 million in attempted transfers of funds stolen in the $387.5 million Bitget hack, freezing $503,000 mid-execution while about $166,000 slipped through, as THORChain faced pressure to block the same attacker addresses.", "detailed_summary_en": "NEAR Intents said its SHIELD system blocked more than $50 million in attempted transfers of funds stolen in the $387.5 million Bitget hack, freezing $503,000 mid-execution while about $166,000 slipped through, as THORChain faced pressure to block the same attacker addresses.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.0, "references": [], "confidence": 0.9, "story_ids": [ "rss:cointelegraph.com_rss:75b832e19ffafcc0", "rss:www.coindesk.com_arc_outboundfeeds_rss_:d88866892901aa48", "rss:thedefiant.io_api_feed:48769194557f3156" ], "sources": [ { "url": "https://cointelegraph.com/news/near-intents-says-it-blocked-50m-tied-to-bitget-hackers?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound", "label": "Cointelegraph", "source_type": "rss", "official": false }, { "url": "https://www.coindesk.com/tech/2026/09/29/usd50-million-in-bitget-hacker-swaps-puts-near-intents-permissionless-claim-to-the-test", "label": "CoinDesk", "source_type": "rss", "official": false }, { "url": "https://thedefiant.io/news/hacks/near-intents-says-it-froze-503-000-in-bitget-hack-funds", "label": "The Defiant", "source_type": "rss", "official": false } ] }, { "update_id": "upd_13fae6e04a35281b", "event_id": "evt_6655595dc1e36e0b", "occurred_at": "2026-09-29T02:05:08Z", "published_at": "2026-09-29T02:05:08Z", "first_seen_at": "2026-09-29T10:50:19.314551Z", "time_precision": "published", "update_type": "aftermath", "material_change": true, "title_zh": "【Bitget BTC 保护基金已流出 3215 枚 BTC，价值约 2.66 亿美元】 Foresight News 消息，据 @ai_9684xtpa 监测", "title_en": "【Bitget BTC 保护基金已流出 3215 枚 BTC，价值约 2.66 亿美元】 Foresight News 消息，据 @ai_9684xtpa 监测", "what_changed_zh": "据@ai_9684xtpa监测，Bitget的BTC保护基金已有3215.28枚BTC（约2.66亿美元）流出链上，原本的5500枚BTC仅剩2284.71枚。", "what_changed_en": "Bitget's BTC protection fund has seen 3,215.28 BTC (~$266M) flow out on-chain, leaving 2,284.71 BTC of the original 5,500 BTC, per @ai_9684xtpa monitoring.", "current_state_zh": "据@ai_9684xtpa监测，Bitget的BTC保护基金已有3215.28枚BTC（约2.66亿美元）流出链上，原本的5500枚BTC仅剩2284.71枚。", "current_state_en": "Bitget's BTC protection fund has seen 3,215.28 BTC (~$266M) flow out on-chain, leaving 2,284.71 BTC of the original 5,500 BTC, per @ai_9684xtpa monitoring.", "detailed_summary_zh": "Bitget's BTC protection fund has seen 3,215.28 BTC (~$266M) flow out on-chain, leaving 2,284.71 BTC of the original 5,500 BTC, per @ai_9684xtpa monitoring.", "detailed_summary_en": "Bitget's BTC protection fund has seen 3,215.28 BTC (~$266M) flow out on-chain, leaving 2,284.71 BTC of the original 5,500 BTC, per @ai_9684xtpa monitoring.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 7.0, "references": [], "confidence": 0.75, "story_ids": [ "telegram:foresightnews:119348" ], "sources": [ { "url": "https://foresightnews.pro/news/h5Detail/114200", "label": "foresightnews", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_63779dae4fbed296", "event_id": "evt_6655595dc1e36e0b", "occurred_at": "2026-09-29T16:18:06Z", "published_at": "2026-09-29T16:18:06Z", "first_seen_at": "2026-09-29T18:12:22.499102Z", "time_precision": "published", "update_type": "aftermath", "material_change": true, "title_zh": "Bitget CEO 对从 3.88 亿美元被盗事件中追回资金“不太乐观”", "title_en": "Bitget CEO ‘not very optimistic’ on recovering funds from $388M breach", "what_changed_zh": "Bitget CEO Gracy Chen 表示对冻结或追回此次约3.88亿美元安全事件损失的资金“不太乐观”，并以2025年2月Bybit被盗约15亿美元、最终仅冻结/追回约8000万美元（约3.5%）为参照。Bitget已推出赏金计划，对冻结资金奖励5%、对追回资金奖励5%。NEAR Intents团队称已拦截逾5000万美元与该攻击相关资产并冻结约50万美元；Chen确认Tether和Circle已将与该漏洞相关的钱包列入黑名单，冻结了318,013枚USDT和USDC。提现恢复分阶段进行：周一开始BTC，周二继续ETH。Chen表示朝鲜可能参与，但未完全排除内部作案的可能性，并称已排除该可能性。", "what_changed_en": "Bitget CEO Gracy Chen said she is 'not very optimistic' about freezing or recovering the funds from the ~$388M breach, citing Bybit's Feb 2025 hack (only ~3.5% of stolen funds frozen) as a reference. Bitget launched a bounty offering 5% for frozen and 5% for recovered funds. NEAR Intents team said it blocked over $50M in assets tied to the attack and froze ~$500K; Chen confirmed Tether and Circle blacklisted a linked wallet, freezing $318,013 in USDT/USDC. Withdrawals resumed in stages: BTC on Monday, ETH on Tuesday. Chen said North Korea may be responsible but did not fully rule out an inside job, though she said that possibility had been ruled out.", "current_state_zh": "Bitget 正分阶段恢复提现（周一BTC，周二ETH），并已启动赏金计划（冻结资金5%、追回资金5%）；NEAR Intents 拦截逾5000万美元相关资产并冻结约50万美元，Tether 与 Circle 已冻结约31.8万美元；CEO Gracy Chen 对追回约3.88亿美元损失“不太乐观”，并称已排除内部作案可能。", "current_state_en": "Bitget is resuming withdrawals in stages (BTC Monday, ETH Tuesday) and launched a bounty (5% for frozen, 5% for recovered funds); NEAR Intents blocked over $50M in related assets and froze ~$500K; Tether and Circle froze ~$318K; CEO Gracy Chen is 'not very optimistic' about recovering the ~$388M loss and said an inside job has been ruled out.", "detailed_summary_zh": "Bitget CEO Gracy Chen said she is 'not very optimistic' about freezing or recovering the funds lost in the exchange's $388 million security breach, citing Bybit's 2025 hack, where only about 3.5% of stolen assets were ever frozen, as a reference point.", "detailed_summary_en": "Bitget CEO Gracy Chen said she is 'not very optimistic' about freezing or recovering the funds lost in the exchange's $388 million security breach, citing Bybit's 2025 hack, where only about 3.5% of stolen assets were ever frozen, as a reference point.", "background_zh": "Bitget 最初将 2026 年 9 月 24 日（周四）的事件报告为约 3.52 亿美元损失并暂停提现，随后 Chen 在“更完整的转账核算”后将该数字更新为约 3.88 亿美元。2025 年 2 月 21 日的 Bybit 被盗事件中约有 15 亿美元的以太币被窃，据报道冻结与追回合计仅约 8000 万美元。此次事件是 2026 年加密行业规模最大的安全事件之一，此前 9 月 Liquid Network 曾遭遇 3.2 亿美元漏洞利用；与 2022 年 Ronin Bridge 的 6.15 亿美元和 2021 年 Poly Network 的 6.11 亿美元相比规模较小。", "background_en": "Bitget initially reported the Thursday, September 24, 2026 incident as a loss of about $352 million and suspended withdrawals, before Chen updated the figure to roughly $388 million after a \"more complete accounting of transfers.\" Bybit's February 21, 2025 hack saw roughly $1.5 billion in Ether stolen, with only about $80 million reportedly frozen and recovered combined. The breach is among the largest to hit crypto in 2026, following a $320 million exploit of the Liquid Network in September, and ranks below the $615 million Ronin Bridge hack in 2022 and the $611 million Poly Network hack in 2021.", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "这一表态对中心化交易所风险认知以及将资产存放于 Bitget 的用户影响最大：报道称冷钱包安全、提现分阶段恢复，限制了直接的流动性传染，但偏低的追回预期会削弱市场对交易所托管的信心。同时，这也凸显稳定币发行方的黑名单机制（Tether 与 Circle 冻结 318,013 美元）是对已追踪被盗资金一条具体但有限的追回渠道。", "market_impact_en": "The signal matters most for centralized-exchange risk perception and for users holding balances on Bitget, since the reported cold-wallet safety and phased withdrawal resumption limit direct liquidity contagion while the low expected recovery rate weighs on confidence in exchange custody. It also highlights stablecoin issuer blacklisting — Tether and Circle freezing $318,013 — as a concrete, if limited, recovery channel for traced exploit funds.", "importance_score": 8.5, "references": [ { "url": "https://www.trmlabs.com/resources/blog/the-bybit-hack-following-north-koreas-largest-exploit", "title": "The Bybit Hack: Following North Korea’s Largest Exploit | TRM Labs" }, { "url": "https://www.bitget.com/campaigns/bitget-security-incident-2026", "title": "Bitget Security Incident (September 2026): Hack Timeline ..." }, { "url": "https://blockonomi.com/stablecoin-issuers-freeze-318k-in-stolen-funds-following-bitget-exchange-breach", "title": "Stablecoin Issuers Freeze $318K in Stolen Funds Following Bitget Exchange Breach - Blockonomi" } ], "confidence": 0.93, "story_ids": [ "rss:cointelegraph.com_rss:63f77747b6fda2d2", "google_news:article:286934996020c0b4", "google_news:article:7580a3f2ce577edd" ], "sources": [ { "url": "https://cointelegraph.com/news/bitget-ceo-gracy-chen-chances-recovering-funds-security-breach?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound", "label": "Cointelegraph", "source_type": "rss", "official": false }, { "url": "https://finance.biggo.com/news/c47bc205-d1b8-43b7-addc-efd88c31d316", "label": "finance.biggo.com", "source_type": "google_news", "official": false }, { "url": "https://www.tradingview.com/news/cointelegraph:5b2742f6b094b:0-bitget-ceo-not-very-optimistic-on-recovering-funds-from-388m-breach/", "label": "TradingView", "source_type": "google_news", "official": false } ] }, { "update_id": "upd_4761a527d237ffe1", "event_id": "evt_6655595dc1e36e0b", "occurred_at": "2026-09-29T19:18:15Z", "published_at": "2026-09-29T19:18:15Z", "first_seen_at": "2026-09-29T23:52:14.237753Z", "time_precision": "published", "update_type": "escalation", "material_change": true, "title_zh": "Bitget 3.88亿美元黑客事件：CEO援引Bybit 3.5%冻结率", "title_en": "Bitget $388M Hack: CEO Cites Bybit's 3.5% Freeze Rate", "what_changed_zh": "Bitget CEO Gracy Chen就交易所3.88亿美元黑客事件后的追回工作作出回应，将其与Bybit 15亿美元被盗事件进行对比，并援引Bybit 3.5%的冻结率作为比较基准。", "what_changed_en": "Bitget CEO Gracy Chen addressed recovery efforts following a $388M hack at the exchange, contrasting them with Bybit's $1.5B breach and citing Bybit's 3.5% freeze rate as a comparative benchmark.", "current_state_zh": "Bitget CEO Gracy Chen就交易所3.88亿美元黑客事件后的追回工作作出回应，将其与Bybit 15亿美元被盗事件进行对比，并援引Bybit 3.5%的冻结率作为比较基准。", "current_state_en": "Bitget CEO Gracy Chen addressed recovery efforts following a $388M hack at the exchange, contrasting them with Bybit's $1.5B breach and citing Bybit's 3.5% freeze rate as a comparative benchmark.", "detailed_summary_zh": "Bitget CEO Gracy Chen addressed recovery efforts following a $388M hack at the exchange, contrasting them with Bybit's $1.5B breach and citing Bybit's 3.5% freeze rate as a comparative benchmark.", "detailed_summary_en": "Bitget CEO Gracy Chen addressed recovery efforts following a $388M hack at the exchange, contrasting them with Bybit's $1.5B breach and citing Bybit's 3.5% freeze rate as a comparative benchmark.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 9.0, "references": [], "confidence": 0.75, "story_ids": [ "google_news:article:12c29691e476e261" ], "sources": [ { "url": "https://financefeeds.com/gracy-chen-compares-bitget-hack-recovery-efforts-with-bybits-1-5b-breach/", "label": "FinanceFeeds", "source_type": "google_news", "official": false } ] }, { "update_id": "upd_9de0dd9c2064ae59", "event_id": "evt_6655595dc1e36e0b", "occurred_at": "2026-09-30T03:01:20Z", "published_at": "2026-09-30T03:01:20Z", "first_seen_at": "2026-09-30T10:38:05.143967Z", "time_precision": "published", "update_type": "aftermath", "material_change": true, "title_zh": "【慢雾余弦：朝鲜黑客利用 Cow 与 Chainflip 跨链转移 Bitget 被盗资金并兑换为 BTC】", "title_en": "【慢雾余弦：朝鲜黑客利用 Cow 与 Chainflip 跨链转移 Bitget 被盗资金并兑换为 BTC】", "what_changed_zh": "慢雾余弦报告朝鲜黑客利用 Cow Protocol 和 Chainflip 跨链转移 Bitget 被盗资金并兑换为 BTC。", "what_changed_en": "SlowMist's Yu Xian reports North Korean hackers are laundering Bitget's stolen funds by using Cow Protocol and Chainflip for cross-chain swaps into BTC.", "current_state_zh": "Bitget 被盗资金正被朝鲜黑客通过 Cow Protocol 和 Chainflip 跨链兑换为 BTC，进行洗钱活动。", "current_state_en": "Bitget's stolen funds are being laundered by North Korean hackers via Cow Protocol and Chainflip cross-chain swaps into BTC.", "detailed_summary_zh": "SlowMist founder Yu Xian reports that North Korean hackers are laundering Bitget's stolen funds by automating Cow Protocol orders routed to pre-staged Chainflip deposit addresses to cross-chain swap the assets into Bitcoin.", "detailed_summary_en": "SlowMist founder Yu Xian reports that North Korean hackers are laundering Bitget's stolen funds by automating Cow Protocol orders routed to pre-staged Chainflip deposit addresses to cross-chain swap the assets into Bitcoin.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 7.0, "references": [], "confidence": 0.9, "story_ids": [ "telegram:foresightnews:119455" ], "sources": [ { "url": "https://foresightnews.pro/news/h5Detail/114294", "label": "foresightnews", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_27eeee702e01c6c8", "event_id": "evt_6655595dc1e36e0b", "occurred_at": "2026-09-30T03:14:53Z", "published_at": "2026-09-30T03:14:53Z", "first_seen_at": "2026-09-30T10:38:03.178269Z", "time_precision": "published", "update_type": "escalation", "material_change": true, "title_zh": "SlowMist：疑似朝鲜黑客通过CoW、Chainfl转移Bitget资金", "title_en": "SlowMist: Suspected North Korean Hackers Route Bitget Funds Through CoW, Chainfl", "what_changed_zh": "SlowMist的MistTrack报告称，疑似朝鲜黑客正利用自动化的CoW Protocol订单洗白从Bitget窃取的资金（约3.5亿美元黑客事件），这些订单将结算资产转入预先生成的Chainflip存款合约，以转换为BTC。", "what_changed_en": "SlowMist's MistTrack reports suspected North Korean hackers are laundering stolen Bitget funds (~$350M hack) by using automated CoW Protocol orders that route settled assets into pre-generated Chainflip deposit contracts for conversion to BTC.", "current_state_zh": "SlowMist的MistTrack报告称，疑似朝鲜黑客正利用自动化的CoW Protocol订单洗白从Bitget窃取的资金（约3.5亿美元黑客事件），这些订单将结算资产转入预先生成的Chainflip存款合约，以转换为BTC。", "current_state_en": "SlowMist's MistTrack reports suspected North Korean hackers are laundering stolen Bitget funds (~$350M hack) by using automated CoW Protocol orders that route settled assets into pre-generated Chainflip deposit contracts for conversion to BTC.", "detailed_summary_zh": "SlowMist's MistTrack reports suspected North Korean hackers are laundering stolen Bitget funds (~$350M hack) by using automated CoW Protocol orders that route settled assets into pre-generated Chainflip deposit contracts for conversion to BTC.", "detailed_summary_en": "SlowMist's MistTrack reports suspected North Korean hackers are laundering stolen Bitget funds (~$350M hack) by using automated CoW Protocol orders that route settled assets into pre-generated Chainflip deposit contracts for conversion to BTC.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.5, "references": [], "confidence": 0.75, "story_ids": [ "telegram:wublockchainenglish:26221" ], "sources": [ { "url": "https://wublockchain.xyz/news/slowmist-suspected-nk-hackers-route-bitget-funds-through-cow-chainflip-21048", "label": "wublockchainenglish", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_f184b5049cebd455", "event_id": "evt_6655595dc1e36e0b", "occurred_at": "2026-09-30T04:08:42Z", "published_at": "2026-09-30T04:08:42Z", "first_seen_at": "2026-09-30T10:38:05.146716Z", "time_precision": "published", "update_type": "confirmation", "material_change": true, "title_zh": "【慢雾：Bitget 热钱包被盗事件涉及第三方产品零日漏洞】", "title_en": "【慢雾：Bitget 热钱包被盗事件涉及第三方产品零日漏洞】", "what_changed_zh": "慢雾初步调查发现，9月25日 Bitget 热钱包被盗源于第三方产品零日漏洞，攻击者利用受影响的内部员工身份及定制提现工具，链上跨链转账持续约2小时52分钟，并后续试图操纵提现记录以触发额外 BTC 提现；慢雾仍在调查攻击者在受影响系统间的移动路径。", "what_changed_en": "SlowMist's preliminary investigation found that the September 25 Bitget hot wallet theft stemmed from a third-party product zero-day exploited with a compromised internal employee identity and a customized withdrawal tool, enabling ~2h52m of cross-chain transfers and further attempts to manipulate withdrawal records to trigger additional BTC withdrawals; SlowMist is still investigating how the attacker moved between affected systems.", "current_state_zh": "SlowMist 初步调查将 9月25日 Bitget 热钱包被盗归因于第三方产品零日漏洞与内部员工身份被利用，攻击者使用定制提现工具并在约2小时52分钟内跨多条链转移资产，还试图触发额外 BTC 提现；慢雾仍在继续调查。此前已分阶段恢复提现、推出赏金计划，NEAR Intents 拦截逾5000万美元相关资产并冻结约50万美元，Tether 与 Circle 冻结约31.8万美元；CEO 对追回约3.88亿美元损失不乐观，且此前称已排除内部作案可能，但初步调查所称内部员工身份被利用与此前说法存在张力。", "current_state_en": "SlowMist's preliminary investigation attributes the September 25 Bitget hot wallet theft to a third-party product zero-day and a compromised internal employee identity, with the attacker using a customized withdrawal tool to move assets across multiple chains over ~2h52m and attempting further BTC withdrawals; SlowMist continues investigating. Previously, Bitget was resuming withdrawals in stages, launched a bounty, NEAR Intents blocked over $50M in related assets and froze ~$500K, Tether and Circle froze ~$318K, and CEO Gracy Chen was 'not very optimistic' about recovering the ~$388M loss while saying an inside job had been ruled out — a statement now in tension with the preliminary finding of a compromised internal employee identity.", "detailed_summary_zh": "SlowMist's preliminary investigation found that the September 25 Bitget hot wallet theft stemmed from a third-party product zero-day exploited with a compromised internal employee identity and a customized withdrawal tool, enabling ~2h52m of cross-chain transfers and further fraudulent BTC withdrawal attempts.", "detailed_summary_en": "SlowMist's preliminary investigation found that the September 25 Bitget hot wallet theft stemmed from a third-party product zero-day exploited with a compromised internal employee identity and a customized withdrawal tool, enabling ~2h52m of cross-chain transfers and further fraudulent BTC withdrawal attempts.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.5, "references": [], "confidence": 0.96, "story_ids": [ "telegram:foresightnews:119467" ], "sources": [ { "url": "https://foresightnews.pro/news/h5Detail/114304", "label": "foresightnews", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_442ea8a8d108ba85", "event_id": "evt_6655595dc1e36e0b", "occurred_at": "2026-09-30T07:34:33Z", "published_at": "2026-09-30T07:34:33Z", "first_seen_at": "2026-09-30T10:38:05.152260Z", "time_precision": "published", "update_type": "remediation", "material_change": true, "title_zh": "【Bitget 已向保护基金划转 2000 枚 BTC，规模回升至 2 亿美元】", "title_en": "【Bitget 已向保护基金划转 2000 枚 BTC，规模回升至 2 亿美元】", "what_changed_zh": "Bitget 从冷钱包划转 2,000 枚 BTC（约 1.66 亿美元）至保护基金地址，使保护基金链上余额回升至 2,484.71 枚 BTC（约 2.06 亿美元），开始兑现一周内补足 3 亿美元的承诺。", "what_changed_en": "Bitget moved 2,000 BTC (~$166M) from its cold wallet to its protection fund address, restoring the fund's on-chain balance to 2,484.71 BTC (~$206M), beginning to fulfill its pledge to replenish the fund to $300M within a week.", "current_state_zh": "SlowMist 初步调查将 9月25日 Bitget 热钱包被盗归因于第三方产品零日漏洞与内部员工身份被利用，攻击者使用定制提现工具并在约 2 小时 52 分钟内跨多条链转移资产，还试图触发额外 BTC 提现；SlowMist 仍在继续调查。此前已分阶段恢复提现、推出赏金计划，NEAR Intents 拦截逾 5000 万美元相关资产并冻结约 50 万美元，Tether 与 Circle 冻结约 31.8 万美元；CEO 对追回约 3.88 亿美元损失不乐观。最新进展：Bitget 已从冷钱包划转 2,000 枚 BTC（约 1.66 亿美元）至保护基金，基金链上余额回升至 2,484.71 枚 BTC（约 2.06 亿美元），兑现一周内补足 3 亿美元承诺。", "current_state_en": "SlowMist's preliminary investigation attributes the September 25 Bitget hot wallet theft to a third-party product zero-day and a compromised internal employee identity, with the attacker using a customized withdrawal tool to move assets across multiple chains over ~2h52m and attempting further BTC withdrawals; SlowMist continues investigating. Previously, Bitget resumed withdrawals in stages, launched a bounty, NEAR Intents blocked over $50M in related assets and froze ~$500K, Tether and Circle froze ~$318K, and CEO Gracy Chen was 'not very optimistic' about recovering the ~$388M loss. Latest development: Bitget has moved 2,000 BTC (~$166M) from its cold wallet to its protection fund, bringing the fund's on-chain balance back to 2,484.71 BTC (~$206M), fulfilling part of its pledge to restore the fund to $300M within a week.", "detailed_summary_zh": "Bitget moved 2,000 BTC (~$166M) from its cold wallet into its protection fund, bringing the fund's on-chain balance back to 2,484.71 BTC (~$206M) as the exchange begins making good on its pledge to restore the fund to $300M within a week.", "detailed_summary_en": "Bitget moved 2,000 BTC (~$166M) from its cold wallet into its protection fund, bringing the fund's on-chain balance back to 2,484.71 BTC (~$206M) as the exchange begins making good on its pledge to restore the fund to $300M within a week.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 7.0, "references": [], "confidence": 0.92, "story_ids": [ "telegram:foresightnews:119492" ], "sources": [ { "url": "https://foresightnews.pro/news/h5Detail/114327", "label": "foresightnews", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_1fd705bb7cd28e87", "event_id": "evt_6655595dc1e36e0b", "occurred_at": "2026-09-30T10:05:39Z", "published_at": "2026-09-30T10:05:39Z", "first_seen_at": "2026-09-30T10:38:20.358795Z", "time_precision": "published", "update_type": "confirmation", "material_change": true, "title_zh": "SlowMist将Bitget黑客活动追溯至8月31日的零日漏洞利用", "title_en": "SlowMist traces Bitget hack activity to Aug. 31 zero-day exploit", "what_changed_zh": "SlowMist 进度报告将 Bitget 被盗事件最早的恶意活动追溯至 8月31日——攻击者利用第三方安全产品零日漏洞；调查还发现攻击者通过隐藏脚本从环境变量获取密码后访问“产品 A”数据库，并在 9月23日与 9月25日于另外两个节点发现类似活动，9月25日又以内部员工身份访问第二款安全产品“产品 B”的管理平台，尝试注入系统命令、篡改服务器配置并上传恶意文件；链上验证显示最早转让发生于 9月25日 UTC+8 凌晨 2:31（93 TRX，11 秒后 0.84 ETH），持续约 2 小时 52 分钟至 5:23。", "what_changed_en": "SlowMist's progress report traces the earliest malicious activity in the Bitget theft to Aug. 31, when an attacker exploited a zero-day in a third-party security product; it also found the attacker accessed 'Product A' database via a hidden script after retrieving its password from an environment variable, with similar activity on two other nodes on Sept. 23 and Sept. 25, and on Sept. 25 accessed a second security product ('Product B') management platform using an internal employee identity, attempting command injection, server config changes and uploading malicious files; on-chain verification found the earliest transfer at 2:31 am UTC+8 Sept. 25 (93 TRX, then 0.84 ETH 11 seconds later), compiled transfers spanning ~2h52m until 5:23 am.", "current_state_zh": "SlowMist 调查将 9月25日 Bitget 热钱包被盗（约 3.88 亿美元）的时间线前推至 8月31日，认定攻击者利用第三方安全产品零日漏洞，经数周潜伏横向移动于两款第三方安全产品及一个钱包应用主机之间，并使用高度定制的删除后提现工具伪造风控参数发起提现；慢雾仍在调查攻击者在受影响系统间的移动路径。Bitget 此前已分阶段恢复提现、推出赏金计划，NEAR Intents 拦截逾 5000 万美元相关资产并冻结约 50 万美元，Tether 与 Circle 冻结约 31.8 万美元；Bitget 已从冷钱包划转 2,000 枚 BTC 至保护基金，基金余额回升至 2,484.71 枚 BTC（约 2.06 亿美元）。", "current_state_en": "SlowMist's investigation pushes the timeline of the Sept. 25 Bitget hot wallet theft (~$388M) back to Aug. 31, attributing it to a third-party security product zero-day; the attacker moved laterally over weeks across two third-party security products and a wallet application host, and used a deleted, highly customized withdrawal tool that forged risk-control parameters to issue withdrawal requests; SlowMist continues investigating how the attacker moved between affected systems. Bitget had previously resumed withdrawals in stages, launched a bounty, NEAR Intents blocked over $50M in related assets and froze ~$500K, Tether and Circle froze ~$318K, and Bitget moved 2,000 BTC from its cold wallet to its protection fund, restoring the fund to 2,484.71 BTC (~$206M).", "detailed_summary_zh": "SlowMist's investigation traced the earliest malicious activity in Bitget's $388 million hack to an Aug. 31 zero-day exploit in a third-party security product, revealing a weeks-long attack campaign.", "detailed_summary_en": "SlowMist's investigation traced the earliest malicious activity in Bitget's $388 million hack to an Aug. 31 zero-day exploit in a third-party security product, revealing a weeks-long attack campaign.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 7.5, "references": [], "confidence": 0.92, "story_ids": [ "rss:cointelegraph.com_rss:1c5a2dda24a0312a" ], "sources": [ { "url": "https://cointelegraph.com/news/bitget-hack-zero-day-slowmist-investigation?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound", "label": "Cointelegraph", "source_type": "rss", "official": false } ] }, { "update_id": "upd_08764820fd803ac2", "event_id": "evt_6655595dc1e36e0b", "occurred_at": "2026-09-30T10:23:24Z", "published_at": "2026-09-30T10:23:24Z", "first_seen_at": "2026-09-30T10:38:05.155975Z", "time_precision": "published", "update_type": "aftermath", "material_change": true, "title_zh": "【Bitget 被盗事件攻击者开始将约 2700 枚 ZEC 转入 Ironwood 屏蔽池】", "title_en": "【Bitget 被盗事件攻击者开始将约 2700 枚 ZEC 转入 Ironwood 屏蔽池】", "what_changed_zh": "链上侦探 ZachXBT 表示，与 Bitget 热钱包被盗事件相关的攻击者已开始将约 2,700 枚 ZEC（约 380 万美元）转入 Zcash 的 Ironwood 屏蔽池；Bitget 热钱包此前共被盗约 1.89 万枚 ZEC（约 2,830 万美元）。", "what_changed_en": "On-chain investigator ZachXBT said the attacker linked to the Bitget hot-wallet theft has started moving roughly 2,700 ZEC (~$3.8M) into Zcash's Ironwood shielded pool; the Bitget hot wallet had lost about 18,900 ZEC (~$28.3M) in total.", "current_state_zh": "慢雾调查将 Bitget 热钱包被盗时间线前推至 8月31日，认定攻击者利用第三方安全产品零日漏洞，经数周潜伏横向移动并使用定制提现工具伪造风控参数发起提现；Bitget 已分阶段恢复提现、推出赏金计划，NEAR Intents 拦截逾 5000 万美元相关资产并冻结约 50 万美元，Tether 与 Circle 冻结约 31.8 万美元，Bitget 已从冷钱包划转 2,000 枚 BTC 至保护基金。最新进展：疑似朝鲜关联的攻击者开始将约 2,700 枚 ZEC（约 380 万美元）转入 Zcash 的 Ironwood 屏蔽池，该批 ZEC 来自此前被盗的约 1.89 万枚 ZEC（约 2,830 万美元）。", "current_state_en": "SlowMist pushed the Bitget hot-wallet theft timeline back to Aug. 31, attributing it to a third-party security product zero-day; the attacker moved laterally over weeks and used a customized withdrawal tool that forged risk-control parameters. Bitget resumed withdrawals in stages, launched a bounty, NEAR Intents blocked over $50M in related assets and froze ~$500K, Tether and Circle froze ~$318K, and Bitget moved 2,000 BTC from its cold wallet to its protection fund. Latest development: the suspected DPRK-linked attacker began moving roughly 2,700 ZEC (~$3.8M) into Zcash's Ironwood shielded pool, part of the ~18,900 ZEC (~$28.3M) stolen from Bitget's hot wallet.", "detailed_summary_zh": "An attacker linked to the Bitget hot-wallet theft has started moving roughly 2,700 ZEC (~$3.8 million) of the ~$28.3 million stolen into Zcash's Ironwood shielded pool, according to on-chain investigator ZachXBT.", "detailed_summary_en": "An attacker linked to the Bitget hot-wallet theft has started moving roughly 2,700 ZEC (~$3.8 million) of the ~$28.3 million stolen into Zcash's Ironwood shielded pool, according to on-chain investigator ZachXBT.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 7.0, "references": [], "confidence": 0.96, "story_ids": [ "telegram:foresightnews:119508", "telegram:wublockchainenglish:26226" ], "sources": [ { "url": "https://foresightnews.pro/news/h5Detail/114339", "label": "foresightnews", "source_type": "telegram", "official": false }, { "url": "https://wublockchain.xyz/news/news-21053", "label": "wublockchainenglish", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_365d7d2b2150dc90", "event_id": "evt_6655595dc1e36e0b", "occurred_at": "2026-09-30T16:28:30Z", "published_at": "2026-09-30T16:28:30Z", "first_seen_at": "2026-09-30T18:04:19.070907Z", "time_precision": "published", "update_type": "remediation", "material_change": true, "title_zh": "Bitget「逐步恢复正常」，保护基金规模达3.09亿美元", "title_en": "Bitget ‘gradually back to usual’ as protection fund reaches $309M", "what_changed_zh": "Bitget CEO Gracy Chen 表示运营正逐步恢复正常，保护基金规模已达到 3.09 亿美元；所有代币提现将于周五恢复，BTC、ETH 和 USDT 提现已先恢复。她同时称该事件造成 3.88 亿美元用户损失，Bitget 仍未排除内部人员或朝鲜黑客等责任方。", "what_changed_en": "Bitget CEO Gracy Chen said operations are gradually returning to normal and the Protection Fund has reached $309M; withdrawals for all tokens will resume Friday, while BTC, ETH and USDT access has already been restored. She said the incident resulted in $388M in user losses and Bitget has still not ruled out an inside job or North Korean hackers.", "current_state_zh": "Bitget 正逐步恢复正常运营，保护基金规模达到 3.09 亿美元；BTC、ETH 和 USDT 提现已恢复，所有代币提现预计周五恢复。CEO 称事件造成 3.88 亿美元用户损失，仍未排除内部人员或朝鲜黑客等责任方；此前已报告的攻击者将 ZEC 转入 Ironwood 屏蔽池等调查仍在继续。", "current_state_en": "Bitget is gradually returning to normal operations, with its Protection Fund reaching $309M; BTC, ETH and USDT withdrawals are restored, and withdrawals for all tokens are expected to resume Friday. The CEO said the incident caused $388M in user losses and that an inside job or North Korean hackers have not been ruled out; prior investigation items such as the attacker moving ZEC into the Ironwood shielded pool continue.", "detailed_summary_zh": "Bitget's CEO said operations are gradually returning to normal after a security breach cost users $388 million, with withdrawals for all tokens resuming Friday, BTC/ETH/USDT access already restored, and the exchange's Protection Fund standing at $309 million.", "detailed_summary_en": "Bitget's CEO said operations are gradually returning to normal after a security breach cost users $388 million, with withdrawals for all tokens resuming Friday, BTC/ETH/USDT access already restored, and the exchange's Protection Fund standing at $309 million.", "background_zh": "此次事件属于加密货币交易所安全漏洞事件的一部分，Bitget的保护基金被宣传为其储备证明（Proof of Reserves）之外的另一层抗风险保障。周三，链上调查人员ZachXBT报告称，与Bitget黑客事件相关的钱包将约380万美元的Zcash（ZEC）转入该网络的Ironwood池，约占此次被盗18,917枚ZEC的14%。NEAR Intents另行表示，其已拦截与Bitget黑客相关的5,000万美元资金。", "background_en": "The incident sits within a broader pattern of crypto exchange security breaches, and Bitget's Protection Fund is marketed as an additional layer of resilience alongside its Proof of Reserves. On Wednesday, blockchain investigator ZachXBT reported that wallets tied to the Bitget hack moved about $3.8 million in Zcash (ZEC) into the network's Ironwood pool — roughly 14% of the 18,917 ZEC stolen in the attack. NEAR Intents separately said it blocked $50 million tied to the Bitget hackers.", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "该事件的传导渠道主要是交易所偿付能力与托管信心：Bitget自身代币及其BTC/ETH/USDT提现通道是直接受影响的板块，而攻击者据报将被盗ZEC转入隐私池的举动，也令隐私资产洗钱渠道受到关注。此类规模的交易所安全事件还可能影响用户对中心化平台托管的信心，以及与交易平台相关的稳定币资金流动。", "market_impact_en": "The event transmits to markets mainly through exchange-solvency and custody sentiment: Bitget's own token and its BTC/ETH/USDT withdrawal rails are the directly exposed segments, while the attackers' reported movement of stolen ZEC into a privacy pool draws attention to privacy-asset laundering channels. Broader exchange-security incidents of this size can also weigh on user confidence in centralized venue custody and on stablecoin flows tied to trading venues.", "importance_score": 8.5, "references": [ { "url": "https://www.bitget.com/promotion/protection-fund", "title": "5500 BTC Protection Fund | Bitget" }, { "url": "https://www.itbitget.com/academy/bitget-protection-fund-to-protect-user-assets", "title": "Bitget Protection Fund to Protect User's Assets" } ], "confidence": 0.92, "story_ids": [ "rss:cointelegraph.com_rss:4a572133f998250e" ], "sources": [ { "url": "https://cointelegraph.com/news/bitget-operations-protection-fund-security-breach?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound", "label": "Cointelegraph", "source_type": "rss", "official": false } ] } ] }