Skip to content

26 results for “Bitget”

ListGrid
What you seeeverything
RecentOldestAddedA–Z
All types26Articles21Write-ups4Talks1
“Bitget”
bleepingcomputer.comarticle🛡️ Security

FBI links $6.3 billion Binance crypto heist to North Korean hackers

The FBI attributed the roughly $6.3 billion Binance theft of about 29 October 2026 to North Korea's TraderTraitor (Lazarus Group, Jade Sleet, APT38). Binance traced the breach to a compromised DevOps engineer's laptop that gave access to a service container used to submit unauthorized withdrawals across ten blockchains. The FBI published 628 laundering addresses and linked the group to earlier thefts at Bybit, DMM Bitcoin, Bitget and Drift.

EthereumBitcoinSolana+3
TraderTraitorLazarus GroupDPRK+14

Threat Intel, Blockchain· Published and added 1 Nov 2026

chainalysis.comarticle🛡️ Security

Binance Exploit: Latest Findings and Response

Chainalysis assesses the 29 October 2026 theft of about $6.4 billion from Binance hot wallets as the work of North Korean group TraderTraitor. Attribution rests on on-chain behavior, including real-time commingling with funds from the Bitget exploit, a Tornado Cash-funded operator wallet and signed authorizations that let a hot wallet run attacker code. About $2.8 billion was frozen. Laundering shows automation, with addresses receiving exactly 1 TRX before forwarding funds.

EthereumTornado CashTron+3
TraderTraitorDPRKBinance+3

Blockchain, Threat Intel· Published and added 30 Oct 2026

socket.devwriteup🛡️ Security

Malicious Firefox Extensions Impersonate Phantom, Jupiter, and Bitget to Steal Wallet Secrets

Socket analysis of three malicious Firefox add-ons impersonating Phantom, Jupiter and Bitget wallets, using Unicode homoglyph names. They steal seed phrases and private keys and send them to brand-named subdomains of bonto[.]io. The Phantom fake adds a runtime loader that fetches and evals a second stage, and bundles a drainer backend with Telegram forwarding. Includes IOCs, hashes and wallet addresses.

FirefoxTelegramCloudflare+3
bonto.ioPhantomJupiter+14

Threat Intel, Malware & RE, Blockchain· Published and added 27 Oct 2026

en.cryptonomist.charticle🛡️ Security

Bitget hacker fund movements top $78.01 million in transfers to new addresses

Bitget breach tracking report: Arkham recorded $19.48 million moved in 52 transfers between 21 and 24 October 2026, and $78.01 million to new addresses from 15 to 23 October. About $242.54 million remains in labeled holdings. It recaps September laundering via Wasabi CoinJoin, THORChain and Chainflip, and Bitget's stated root cause, a flaw in a third-party security product.

BitcoinEthereumTHORChain+3
BitgetArkhamAMLBot+5

Blockchain, Threat Intel· Published and added 24 Oct 2026

galaxy.comarticle🛡️ Security

Weekly Research Brief: Ledger’s $91M Theft, Papertrade

Galaxy Research's weekly brief leads with the roughly $91M theft from Ledger devices sold via the reseller CryptoBilis. A hidden hardware implant read the 24-word recovery phrase off the screen during setup and sent it over LTE through an eSIM, leaving the Secure Element untouched so Genuine Check still passed. Galaxy's onchain tally covers 474 victim addresses, 88% of the value moved in one hour on Oct. 9, and about $56.6M was still parked as of Oct. 15, with Tornado Cash use and a $10M Tether freeze. It places the theft alongside the Coldcard weak-seed, Liquid peg-out and Bitget compromises, and ends with buyer and custody advice. The Papertrade and OCC debanking sections are unrelated to security.

LedgerColdcardBitcoin+2
CryptoBilisGenuine CheckTornado Cash+8

Blockchain, Hardware & RF, Supply Chain· Added 16 Oct 2026

galaxy.comarticle🛡️ Security

Inside the $91M Ledger Reseller Wallet Theft

Galaxy Research newsletter piece on the roughly $91M theft from buyers of Ledger hardware wallets sold by the reseller CryptoBilis. A hidden component reads the 24-word recovery phrase off the screen during setup and sends it over LTE via an eSIM. The Secure Element and Genuine Check are untouched, so the check passes on tampered units. It traces the drain across 474 victim addresses on Bitcoin, Ethereum and TRON, including 88% of the value moving in one hour on Oct. 9, and the laundering and freezes (Tornado Cash, Tether). It also places the incident among the quarter's other custody and infrastructure failures (Coldcard weak seeds, Liquid, Bitget) and gives buying and operational guidance.

LedgerBitcoinEthereum+2
CryptoBilishardware implantGenuine Check+9

Blockchain, Hardware & RF, Supply Chain· Added 16 Oct 2026

galaxy.comarticle🛡️ Security

Weekly Research Brief: Bitget Hack, AI Accord and SEC FAQs

Galaxy Research's weekly brief includes a detailed postmortem of the $387.5M Bitget hack: attackers exploited a zero-day in two unnamed third-party security products ("Product A"/"Product B") to obtain high-level internal credentials, inserted forged withdrawal commands into Bitget's wallet backend across 11 chains, then deleted the fraudulent commands — with Bitget attributing the attack to North Korean actors based on IP behavior and wallet overlaps found by Elliptic and TRM. The piece draws a direct parallel to the $1.5B Bybit/Lazarus heist (compromised Safe{Wallet} infrastructure rather than stolen keys) to argue that private-key cryptography is effectively solved and attackers now target the approval pipeline/intermediary services instead; it also covers the follow-on $3.8M NEAR Intents Omni-bridge exploit and THORChain's continued role laundering DPRK proceeds. The newsletter's other sections (White House "Super Intelligence" AI Accord, SEC crypto buyback FAQs) are policy commentary, not security-technical.

THORChainGnosis Safe
BitgetLazarus GroupDPRK+8

Blockchain, Threat Intel· Added 8 Oct 2026

decrypt.coarticle🛡️ Security

'We Have Identified You, Sir': Near Intents Recovers $3.8 Million After 48-Hour Ultimatum

NEAR Intents, a cross-chain swap protocol, suffered a $3.8M exploit caused by a bug in how its Omni deposit/withdrawal layer interacted with its main smart contract. General manager Alex Shevchenko publicly identified the attacker, gave a 48-hour ultimatum to return the funds as a last-chance responsible-disclosure offer, and the full amount was returned after an on-chain apology message. The stolen funds had briefly moved through KuCoin and were bridged to Bitcoin, traced by ZachXBT; separately, days earlier NEAR Intents had blocked a $50M swap attempt tied to the DPRK-linked Bitget hacker.

BitcoinSolanaEthereum
ZachXBTNEAR IntentsBitget+4

Blockchain· Published and added 4 Oct 2026

rekt.newswriteup🛡️ Security

Bitget — Rekt

A rekt.news investigative timeline of the September 24, 2026 Bitget exchange breach, in which attackers exploited a zero-day in an unnamed third-party security product ("Product A"/"Product B") to gain privileged access, move laterally to Bitget's production wallet job server, and use a custom tool to forge risk-control parameters and invoke fraudulent withdrawals — draining $387.5M in ETH, XRP, Zcash and TRON without ever touching private keys or cold wallets. It synthesizes Mandiant's and SlowMist's incident-response reports, on-chain tracing from Arkham, Hacken, Bubblemaps, AMLBot, Bitquery and MistTrack showing laundering through THORChain and attempted NEAR Intents swaps, TRM Labs' partial linkage of the laundering infrastructure to prior North Korea-linked (TraderTraitor) hacks, and the public clash between Bitget's Gracy Chen and THORChain over refusing service to attacker addresses.

EthereumBitcoinXRP+3
BitgetMandiantSlowMist+8

Blockchain, Threat Intel· Added 3 Oct 2026

decrypt.coarticle🛡️ Security

Chainalysis Used AI to Trace the $387M Bitget Hack Back to North Korea

Chainalysis published an attribution report tying the September 24 $387M Bitget exchange hack to North Korea-linked actors, pushing DPRK's 2026 crypto theft total past $1 billion. The report details the attackers' laundering path: $387M moved in 23 transfers within three hours across Ethereum (49.7%), XRP (40.8%), Zcash (7.6%) and Tron (1.8%), with stolen XRP routed through a cross-chain liquidity protocol into Bitcoin rather than an exchange. Chainalysis also disclosed it used in-house AI automation to compress over 20 hours of manual bridge-transaction reconciliation into under 10 minutes, with humans still directing the investigation.

ChainalysisEthereumBitcoin+1
Gracy ChenNear IntentsElliptic

Blockchain, Threat Intel, AI Security· Published and added 3 Oct 2026

galaxy.comarticle🛡️ Security

Déjà Vu, Lazarus Crew: $387.5m Bitget Exploit Repeats a Pattern

Galaxy Research post-mortem on the $387.5m Bitget hot/warm wallet theft across 11 chains, attributed to North Korean (Lazarus/DPRK) actors via IP behavior and onchain wallet-overlap analysis by Elliptic and TRM. SlowMist traced the intrusion to a zero-day exploit against two unnamed third-party security vendors ("Product A"/"Product B") that let attackers insert and then delete fraudulent withdrawal commands in Bitget's wallet backend, rather than compromising private keys or cold storage. The piece draws a direct parallel to the February 2025 Bybit/Safe{Wallet} $1.5B theft (doctored signing interface) and the same-week NEAR Intents $3.8m hot-wallet exploit, arguing that private-key cryptography is now reliably secure so attackers instead target the intermediary infrastructure/pipeline that authorizes transactions, with stolen funds repeatedly laundered through THORChain.

THORChainNEAR IntentsGnosis Safe+1
Lazarus GroupDPRKBitget+6

Blockchain, Threat Intel· Added 2 Oct 2026

thehackernews.comarticle🛡️ Security

Bitget Confirms Third-Party Zero-Day Behind $387.5 Million Cryptocurrency Theft

The Hacker News reports Bitget's confirmation that attackers exploited a zero-day vulnerability in unnamed third-party security products ("Product A" and "Product B") to steal $387.5 million in cryptocurrency across 11 blockchains in September 2026. SlowMist's investigation traced the intrusion back to August 31, showing attackers read database credentials via a hidden script, later hijacked an employee identity to inject commands into Product B's management platform, and deployed a web shell with C2 access; Mandiant found the attackers pivoted from the compromised security appliances into Bitget's production wallet job server to deploy a custom withdrawal-draining tool that bypassed risk controls. Bitget, citing IP patterns and on-chain analysis corroborated by Elliptic and TRM Labs, attributes the heist to North Korean threat actors with wallet overlaps linking it to prior laundering operations.

Ethereum
BitgetDPRKSlowMist+6

Blockchain, Threat Intel· Added 2 Oct 2026

thedefiant.ioarticle🛡️ Security

Chainalysis Links $387 Million Bitget Hack to North Korea

Chainalysis attributes the $387 million Bitget exchange hack to North Korea, pushing DPRK-linked crypto theft totals above $1 billion for 2026. Onchain records show the stolen XRP being laundered by swapping it through the THORChain cross-chain protocol.

THORChainXRPChainalysis
DPRKBitget

Blockchain, Threat Intel· Published and added 2 Oct 2026

opensourcemalware.comtalk🛡️ Security

The OpenSourceMalware Show #23

Episode 23 of the OpenSourceMalware Show covers the arrest of ShinyHunters figure Pepijn van der Stap (Umbreon) and three KillSec ransomware suspects, a suspected North Korean theft of $351.6M from crypto exchange Bitget via a zero-day in a security product (per incident responder SlowMist), a signed macOS installer impersonating Claude Desktop and hosted on GitHub, over 100 malicious npm packages abusing the Baileys WhatsApp library to inflate channel followers, and DPRK's PolinRider campaign renaming its fake-font payload (fa-solid-400.woff2 variants, now using a .llf extension and nested folder paths) to evade static file-name detections.

npmGitHubClaude Desktop+2
ShinyHuntersKillSecPepijn van der Stap+14

Threat Intel, Blockchain, Supply Chain· Added 1 Oct 2026, published 2 Oct 2026

cryptoslate.comarticle🛡️ Security

Crypto hackers have taken $2.7 billion in 2026 and the losses are alarmingly concentrated

CryptoSlate aggregates CertiK and Elliptic data showing crypto firms and users lost nearly $2.7 billion to security incidents in the first nine months of 2026, with five mega-breaches (Bitget $387.5M, Liquid Network $318.7M, KelpDAO $291.3M, Drift Protocol $285.3M, and one unidentified $284.8M victim) accounting for 59% of total losses. Elliptic attributes over $1 billion of 2026 thefts across 51+ incidents to North Korea, including the Bitget breach, extending a DPRK crypto-theft campaign that has netted over $6 billion since 2017 and includes prior attacks like Ronin Bridge, Atomic Wallet, and the $1.46 billion Bybit theft. The piece also notes a rise in physical "wrench attacks" (52 incidents, $124.2M exposure in H1 2026) and increasingly sophisticated cross-chain laundering techniques used by state-linked actors.

EthereumBitget
CertiKEllipticLiquid Network+8

Blockchain, Threat Intel· Added 3 Oct 2026, published 2 Oct 2026

chainalysis.comwriteup🛡️ Security

How AI Helped Chainalysis Investigators Trace the $387 Million North Korea Stole from Bitget

Chainalysis describes its investigation into the September 24, 2026 DPRK-attributed theft of $387 million from exchange Bitget, which within three hours moved across Ethereum (49.7%), XRP (40.8%), Zcash (7.6%), and Tron (1.8%). The team built custom in-house AI automation to reconcile cross-chain bridge activity (compressing 20+ hours of manual work to under 10 minutes) and traced stolen XRP through a cross-chain liquidity protocol into Bitcoin, pushing 2026 North Korea-attributed crypto theft past $1 billion.

EthereumBitcoinTron+2
BitgetDPRK

Blockchain, Threat Intel, AI Security· Added 7 Oct 2026, published 1 Oct 2026

decrypt.coarticle🛡️ Security

Bitget Hacker Turns to Zcash Privacy Pool After Near Rejects $50M in Swaps

Decrypt reports that the attacker behind Bitget's $387.5M hot-wallet theft (Sept. 24) began shielding ~2,700 ZEC (~$3.8M) in Zcash's new Ironwood privacy pool, per on-chain investigator ZachXBT. Bitget's CEO and Elliptic attribute the heist to North Korea, and TRM Labs traced laundering through round-number wallet splits and cross-chain swap services including Thorchain, Across, Bridgers, Chainflip, and FixedFloat. Near Intents' SHIELD screening blocked over $50M in related swaps while Thorchain refused to selectively halt the attacker's addresses, spotlighting the gap between blockchain "permissionless" design and real-time sanctions/freeze response during active exchange-hack laundering.

ZcashTHORChain
ZachXBTTRM LabsElliptic+3

Blockchain· Published and added 30 Sep 2026

coindesk.comarticle🛡️ Security

Bitget hackers move $4 million into Zcash’s private pool, making funds harder to trace

CoinDesk traces wallets linked to the Sept. 24 Bitget hack ($387.5M stolen) moving 2,746 ZEC (~$3.9M, ~15% of stolen ZEC) into Zcash's Ironwood shielded pool via two intermediary addresses, obscuring sender, recipient and amount once inside the pool. Blockchain investigator ZachXBT first flagged the transfers; separately, other attacker-linked proceeds were previously traced swapping ~$6.3M ether to bitcoin via THORChain despite the exchange's request to block the hacker. The piece illustrates real-world laundering tradecraft (privacy-pool deposits plus cross-chain DEX swaps) and the limits of on-chain tracing once funds enter a shielded pool.

ZcashTHORChainEthereum+1
Bitget hackZachXBTIronwood shielded pool

Blockchain, Threat Intel· Published and added 30 Sep 2026

bankless.comarticle🛡️ Security

NEAR Stopped Bitget's Hackers Without Breaking Privacy

Following the ~$387.5M Bitget hack on September 24th (attributed to North Korea-pattern tactics), attackers tried to launder funds via crosschain rails: THORChain refused Bitget's request to block the hacker's address and later saw $6M+ swapped through it, while NEAR Intents' SHIELD risk-intel layer rejected nearly all of a $50M+ attempted transfer, letting only $166k through. The piece explains the architecture: deposits/withdrawals are public on-chain transactions, but balances/routes/trades happen inside NEAR's Confidential Intents, and SHIELD acts as a gate checking public deposit addresses against shared stolen-funds intel before allowing Intents execution — without unmasking or freezing wallets, since Intents sits atop NEAR's consensus rather than being part of it. It also notes SHIELD's limits (funds simply got rerouted elsewhere) and NEAR co-founder Illia Polosukhin's pitch to make SHIELD shared infra other protocols can adopt.

NEAR IntentsTHORChainEthereum+1
Bitget hackBybit hackDPRK+4

Blockchain, Threat Intel· Added 30 Sep 2026, published 29 Sep 2026

coindesk.comarticle🛡️ Security

Near Intents blocks $50 million in Bitget hacker swaps, here's what happened

After attackers stole $388M from Bitget, they tried routing $50M+ through the cross-chain swap service NEAR Intents; its SHIELD system — which ingests KYT and intelligence-provider signals to flag deviations in flow — froze roughly $503,000 mid-swap while $166,000 slipped through. The piece contrasts this with THORChain's refusal to block the same attacker addresses, letting $6.3M complete ether-to-bitcoin swaps, and details the resulting debate over whether a "permissionless" protocol can hold user funds without a defined process for release or appeal.

NEAR IntentsTHORChainBitcoin+1
Bitget hackSHIELDAlex Shevchenko+1

Blockchain, Threat Intel· Added 30 Sep 2026, published 29 Sep 2026

theblock.coarticle🛡️ Security

Bitget attacker tested risk controls with small transfers before $388 million theft, CEO says

The Block interviews Bitget CEO Gracy Chen about the 24 September 2026 theft of about $388 million. The attacker used a zero-day in a third-party security product to gain admin access, injected fraudulent withdrawal commands into wallet backends and deleted traces. Small test transfers (0.184 ETH, 193 TRX) fell below risk-control thresholds before 17 larger transfers across eight chains. Bitget says private keys and cold wallets were safe; Mandiant and SlowMist are investigating.

BitgetMandiantSlowMist+2

Threat Intel· Added 12 Oct 2026, published 28 Sep 2026

research.checkpoint.comarticle🛡️ Security

Check Point Research — 28th September Threat Intelligence Report

Check Point Research's weekly threat intelligence roundup covering the FBIjobs.gov defacement by ShinyHunters, a $351.6M Bitget hot-wallet theft with suspected DPRK involvement, and breaches at Astrana Health and LMU Munich. It also details AI-driven threats (an OpenAI agent's unauthorized access to an Australian government Medicare portal, an AI-agent-automated retail fraud campaign, and the CLOSEDQUORUM Windows malware that queries four commercial AI models to pick its post-compromise actions), four actively exploited pre-auth RCE CVEs (Check Point Security Gateway/Management, F5 BIG-IP APM, WordPress), and campaign writeups on the Storm-2570 multi-ransomware affiliate, an INC ransomware intrusion, a TeamFiltration M365 account-takeover wave in Latin America, and Storm-3168/JADEPUFFER's destructive Azure operations.

F5 BIG-IPWordPressMicrosoft 365+4
CVE-2026-85102CVE-2026-93616CVE-2026-94127+17

Threat Intel, AI Security, AppSec· Added 1 Oct 2026, published 28 Sep 2026

coindesk.comarticle🛡️ Security

THORChain rejects Bitget request to block hacker as $6 million moves to bitcoin

CoinDesk traced 27 successful THORChain swaps converting roughly 2,390 ETH into 75.2 BTC for a wallet linked to the attacker behind Bitget's $388M Sept. 24 breach, all payouts routed to a single bitcoin address. Bitget publicly asked THORChain to block the attacker's identified addresses and offered a 5% bounty for freezing or recovering funds, but THORChain refused selective blacklisting, saying its emergency controls can only halt an entire chain's activity, not target individual addresses — a stance it also held after its own $10.7M May exploit.

THORChainEthereumBitcoin
BitgetLookonchainGracy Chen

Blockchain, Threat Intel· Added 30 Sep 2026, published 28 Sep 2026

theblock.coarticle🛡️ Security

Bitget starts phased withdrawal resumption following $388 million exploit

Bitget began phased withdrawal resumption after a 24 September 2026 exploit drained about $388M from its hot and warm wallets. The attacker used a vulnerability in a third-party security product to obtain internal credentials and send fraudulent withdrawal commands. Bitget says private keys, user balances and cold wallets were unaffected, and suspects North Korea. Mandiant and SlowMist are investigating; the report gives no technical detail on the flaw.

BitgetDPRKMandiant+1

Threat Intel, Blockchain· Added 11 Oct 2026, published 28 Sep 2026

bankless.comarticle🛡️ Security

Bitget Hacked for $351.6M

Bitget disclosed a $351.6M hot-wallet breach in which attackers did not compromise private keys but instead breached a core wallet backend and spoofed transaction data to trick Bitget's own authorization process into approving transfers. Attackers quickly converted most stolen EVM assets into 67,982 ETH (~$183M) and also took ~103M XRP to move into harder-to-freeze native assets, while Bitget's CEO and independent researcher Specter linked the attack to North Korea via VPN IP overlap and onchain infrastructure tied to the earlier AFX exploit attributed to TraderTraitor.

EthereumXRP
BitgetDPRKTraderTraitor+4

Blockchain, Threat Intel· Added 8 Oct 2026, published 25 Sep 2026

socket.devwriteup🛡️ Security

Socket: FUNNULL iOS Spyware Campaign via 13 Malicious Packagist Themes

Socket's Threat Research Team traced 13 malicious Composer/Packagist theme packages (across vsmov, vsphim, haiau009, chilltvcms, ophimcms vendors) used by Vietnamese movie/comic streaming sites, which inject JavaScript running an ad-fraud/gambling redirect on all mobile visitors and, on unpatched iPhones, chain WebKit exploits (CVE-2025-31277, CVE-2025-43529) through a GPU-process pivot into a kernel escape via the AppleM2ScalerCSCDriver IOKit client (related to CVE-2026-43655) to install spyware. The payload exfiltrates keychain data, SMS, photos, contacts, and — after an August 2026 redeployment — directly steals crypto wallet seeds/mnemonics from Bitget, Phantom, Trust Wallet, and others. The report attributes delivery infrastructure to FUNNULL (Triad Nexus, OFAC-sanctioned operator Liu Lizhi), ties the exploit kit to the "DarkSword" iOS exploit family, and provides full IOCs, hashes, and MITRE ATT&CK mapping.

PackagistComposerPHP+4
CVE-2025-31277CVE-2025-43529CVE-2026-43655+8

Supply Chain, Mobile Security, Threat Intel· Published and added 1 Sep 2026