{ "version": 1, "event_id": "evt_6655595dc1e36e0b", "url": "https://xiyu.news/events/evt_6655595dc1e36e0b/", "json": "https://xiyu.news/api/events/evt_6655595dc1e36e0b.json", "type": "security_incident", "status": "closed", "category": "crypto", "title": { "zh": "Bitget 遭朝鲜关联黑客攻击，约3.88亿美元被盗", "en": "Bitget Suffers DPRK-Linked Hack with Roughly $388M Stolen" }, "current_state": { "zh": "Chainalysis 将 3.87 亿美元的 Bitget 黑客攻击归因于与朝鲜有关的黑客，使 2026 年归因于朝鲜的加密货币盗窃金额超过 10 亿美元，链上记录显示被盗的 XRP 通过 THORChain 进行兑换；Chainalysis 使用内部 AI 加速追踪，且新报道补充 Near Intents 拒绝超 5000 万美元相关兑换后自身遭攻击、THORChain 继续处理、Circle 和 Tether 冻结约 31.8 万美元稳定币。", "en": "Chainalysis attributes the $387 million Bitget hack to North Korea-linked hackers, bringing DPRK-attributed crypto theft above $1 billion in 2026, with on-chain records showing the stolen XRP being swapped through THORChain; Chainalysis used in-house AI to accelerate tracing, and reporting adds that Near Intents rejected over $50M in related swaps before being hacked, THORChain kept processing, and Circle and Tether froze about $318k in stablecoins." }, "first_seen_at": "2026-09-24T23:18:03.365059+00:00", "last_updated_at": "2026-10-08T07:02:00.655010+00:00", "last_material_change_at": "2026-10-03T20:41:59.640858+00:00", "confidence": 0.75, "updates_count": 29, "sources_count": 77, "entities": [ "about", "accounting", "across", "actors", "addresses", "affected", "after", "already", "american", "amid", "and", "around", "assets", "attributes", "aug", "away", "back", "bazaar", "beincrypto", "biggest", "binance", "bitget", "bitget-hack", "block", "breach", "brief", "btc", "but", "bybit", "ceo", "chainalysis", "chainfl", "chainflip", "challenges", "chen", "circle", "cites", "claims", "clarification", "climb", "coinbase", "coinfomania", "cow", "crypto-security", "cryptonomist", "decentralization", "demand", "dprk", "estimate", "etf", "etf-inflows", "exchange", "exploit", "exposes", "fallout", "familiar", "fed", "foresight", "freeze", "from", "funds", "giwa", "gone", "goplus", "gracy", "gradually", "hack", "hacked", "hacker", "hackers", "happened", "here", "hokanews", "hot", "hot-wallet", "hot-wallet-breach", "incident", "intellectia", "intents", "investment", "ironwood", "issues", "korea", "korean", "links", "losses", "million", "morning", "most", "movement", "near", "near-intents", "nearly", "news", "north", "north-korea", "odds", "offers", "official", "pattern", "pluang", "project", "protection-fund", "pushes", "raises", "rate", "recap", "recovering", "refuses", "rejects", "reopens", "repeats", "request", "resume", "ripple", "route", "says", "security-breach", "sees", "september", "slim", "slip", "slowmist", "stablecoins", "stolen", "substack", "suddenly", "support", "suspect", "suspected", "suspends", "swapping", "swiss", "tether", "thorchain", "through", "tied", "timeline", "token", "trace", "traces", "tradingview", "upbit", "usdt", "used", "vanishes", "wallet", "wallets", "what", "why", "widens", "withdrawals", "xrp", "zec", "zero-day" ], "identifiers": [], "topics": [ "aml-kyt", "asset-recovery", "attribution", "binance", "bitget", "bitget-hack", "blockchain-forensics", "btc", "bybit", "censorship-resistance", "certik", "chainalysis", "chainflip", "circle", "coinbase", "cross-chain", "cross-chain-bridges", "crypto-exchanges", "crypto-security", "custody", "custody-risk", "cz", "decentralization", "defi-governance", "dprk", "etf-inflows", "exchange-breach", "exchange-funds", "exchange-hack", "exchange-investment", "exchange-operations", "exchange-reserves", "exchange-security", "exchanges", "fund-loss", "fund-recovery", "fund-safety", "fund-tracing", "giwa", "hack", "hack-recovery", "hacked-funds", "hacks", "hot-wallet", "hot-wallet-breach", "hot-wallets", "incident-response", "industry-response", "institutional-custody", "lazarus", "lazarus-group", "money-laundering", "near-intents", "north-korea", "north-korea-hacking", "on-chain", "on-chain-data", "on-chain-forensics", "on-chain-monitoring", "onchain-forensics", "protection-fund", "protocol-governance", "q3-losses", "security-breach", "security-incident", "slowmist", "stablecoin-freeze", "stablecoin-regulation", "stolen-funds", "sygnum", "tether", "thorchain", "thorswap", "upbit", "user-protection-fund", "withdrawal-suspension", "withdrawals", "withdrawals-suspended", "xrp", "xrp-ledger", "zcash", "zero-day" ], "updates": [ { "update_id": "upd_5d96c2f2a2d99557", "event_id": "evt_6655595dc1e36e0b", "occurred_at": "2026-09-24T21:59:32Z", "published_at": "2026-09-24T21:59:32Z", "first_seen_at": "2026-09-24T23:18:03.365059Z", "time_precision": "published", "update_type": "initial", "material_change": true, "title_zh": "加密货币交易所Bitget称黑客攻击影响3.52亿美元，声称用户资金“安全”", "title_en": "Crypto exchange Bitget says $352 million affected in a hack, claims user funds are 'safe'", "what_changed_zh": "Bitget CEO陈樱棋披露了一起安全漏洞事件，热钱包和温钱包遭未授权转账，涉及约3.516亿美元，她表示冷钱包和用户资金安全，提现暂时暂停以待安全审查。", "what_changed_en": "Bitget CEO Gracy Chen disclosed a breach exposing about $351.6 million through unauthorized transfers from hot and warm wallets, saying cold wallets and user funds are safe while withdrawals are temporarily paused pending a security review.", "current_state_zh": "Bitget CEO陈樱棋披露了一起安全漏洞事件，热钱包和温钱包遭未授权转账，涉及约3.516亿美元，她表示冷钱包和用户资金安全，提现暂时暂停以待安全审查。", "current_state_en": "Bitget CEO Gracy Chen disclosed a breach exposing about $351.6 million through unauthorized transfers from hot and warm wallets, saying cold wallets and user funds are safe while withdrawals are temporarily paused pending a security review.", "detailed_summary_zh": "Bitget CEO Gracy Chen disclosed a breach exposing about $351.6 million through unauthorized transfers from hot and warm wallets, saying cold wallets and user funds are safe while withdrawals are temporarily paused pending a security review.", "detailed_summary_en": "Bitget CEO Gracy Chen disclosed a breach exposing about $351.6 million through unauthorized transfers from hot and warm wallets, saying cold wallets and user funds are safe while withdrawals are temporarily paused pending a security review.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 9.5, "references": [ { "url": "https://en.wikipedia.org/wiki/Bitget", "title": "Bitget - Wikipedia" }, { "url": "https://www.investopedia.com/hot-wallet-vs-cold-wallet-7098461", "title": "investopedia.com/hot-wallet-vs-cold-wallet-7098461" } ], "confidence": 0.75, "story_ids": [ "rss:www.coindesk.com_arc_outboundfeeds_rss_:1b10589a8507c69e", "rss:cryptoslate.com_feed_:b061029d7bcbdcd2", "rss:decrypt.co_feed:48e80437d7caa4bc", "rss:www.theblock.co_rss.xml:b2a2d75ef96dbad1", "rss:thedefiant.io_api_feed:e60d246ee5c2df24", "google_news:article:6df83a6563764b27", "rss:cointelegraph.com_rss:205852e2ae6ba20a" ], "sources": [ { "url": "https://www.coindesk.com/markets/2026/09/24/crypto-exchange-bitget-loses-usd352-million-in-hack-claims-user-funds-are-safe", "label": "CoinDesk", "source_type": "rss", "official": false }, { "url": "https://cryptoslate.com/bitgets-351-6-million-hack-pushes-september-crypto-losses-to-2026-high/", "label": "CryptoSlate", "source_type": "rss", "official": false }, { "url": "https://decrypt.co/379275/bitget-hack-183-million-crypto-exchange-wallets", "label": "Decrypt", "source_type": "rss", "official": false }, { "url": "https://www.theblock.co/news/markets/2026-09-24-more-than-170-million-in-crypto-moves-from-bitget-wallets-unidentified-address-416345", "label": "The Block", "source_type": "rss", "official": false }, { "url": "https://thedefiant.io/news/cefi/bitget-disables-withdrawals-165-million-one-address-four-chains", "label": "The Defiant", "source_type": "rss", "official": false }, { "url": "https://news.google.com/rss/articles/CBMidkFVX3lxTE5KbmJ4OE00SE1XVEwwcHVPWDIycUtoSTVEdUx1Z0ZWNEM5a2ZoQXRzenRFUlg5RmZid05hSXV3NERvdzlLM0tmZG04eXZQdk1xNlJzZG0wMlJWZ3RMa0NwYWhxX0ZhZFNMYmRmTmNVWEtFcTZMTmc?oc=5", "label": "finance.biggo.com", "source_type": "google_news", "official": false }, { "url": "https://cointelegraph.com/news/bitget-calls-security-withdrawal-claims-unverified-amid-178m-breach-reports?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound", "label": "Cointelegraph", "source_type": "rss", "official": false } ] }, { "update_id": "upd_74d4ec403dffaaa9", "event_id": "evt_6655595dc1e36e0b", "occurred_at": "2026-09-25T04:11:21Z", "published_at": "2026-09-25T04:11:21Z", "first_seen_at": "2026-09-25T09:43:54.635746Z", "time_precision": "published", "update_type": "escalation", "material_change": true, "title_zh": "Bitget黑客事件：3.516亿美元被盗，2026年最大规模入侵——shattered.io", "title_en": "Bitget Hack: $351.6M Stolen, Biggest Breach of 2026 - shattered.io", "what_changed_zh": "据报道，Bitget遭遇安全漏洞，3.516亿美元被盗，被称为2026年最大规模的加密货币交易所黑客事件。", "what_changed_en": "Bitget is reported to have suffered a security breach in which $351.6M was stolen, described as the largest crypto exchange hack of 2026.", "current_state_zh": "据报道，Bitget遭遇安全漏洞，3.516亿美元被盗，被称为2026年最大规模的加密货币交易所黑客事件。", "current_state_en": "Bitget is reported to have suffered a security breach in which $351.6M was stolen, described as the largest crypto exchange hack of 2026.", "detailed_summary_zh": "Bitget is reported to have suffered a security breach in which $351.6M was stolen, described as the largest crypto exchange hack of 2026.", "detailed_summary_en": "Bitget is reported to have suffered a security breach in which $351.6M was stolen, described as the largest crypto exchange hack of 2026.", "background_zh": "Bitget 于 2018 年在新加坡成立，早期业务以加密衍生品和跟单交易为主，此后扩展为更综合的交易平台。赵长鹏创立了按交易量计全球最大的加密货币交易所币安，并已卸任首席执行官；他在服完四个月刑期后于 2024 年 9 月获释。赵长鹏的公开表态在交易所行业内持续受到关注。", "background_en": "Bitget was founded in Singapore in 2018 and built its early business around crypto derivatives and copy trading before expanding into a broader trading platform. Changpeng Zhao founded Binance, the largest cryptocurrency exchange by trading volume, and stepped down as CEO; he was released from US custody in September 2024 after serving a four-month sentence. Public statements by CZ continue to draw attention across the exchange industry.", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "传导渠道是交易所风险与托管信心：Bitget 遭遇的 3.88 亿美元攻击使其用户和交易对面临提现中断与流动性压力的风险，同时让市场对整个中心化交易所安全性的关注度上升。影响主要集中在 Bitget 自身平台及其用户群，而非全系统性；报道本身无法推断任何具体资产的价格走向。", "market_impact_en": "The transmission channel is exchange risk and custody confidence: a $388 million breach at Bitget exposes its users and trading pairs to withdrawal disruptions and liquidity strain, while drawing fresh scrutiny to centralized exchange security broadly. The impact is concentrated on Bitget's own venue and user base rather than system-wide, and no specific asset price outcome can be inferred from the report.", "importance_score": 9.0, "references": [ { "url": "https://www.cnbc.com/2026/09/25/crypto-platform-bitget-suspects-north-korea-in-352-million-hack.html", "title": "Crypto platform Bitget suspects North Korea in $352 million hack" }, { "url": "https://en.wikipedia.org/wiki/Lazarus_Group", "title": "Lazarus Group - Wikipedia" }, { "url": "https://www.trmlabs.com/resources/blog/north-korea-stole-76-of-all-crypto-hack-value-in-2026-with-just-two-attacks", "title": "North Korea Stole 76% of All Crypto Hack Value in 2026 — With Just Two Attacks | TRM Labs" }, { "url": "https://en.wikipedia.org/wiki/Bitget", "title": "Bitget - Wikipedia" }, { "url": "https://en.wikipedia.org/wiki/Changpeng_Zhao", "title": "Changpeng Zhao - Wikipedia" }, { "url": "https://www.forbes.com/sites/digital-assets/article/what-is-bitget/", "title": "What Is Bitget? A Guide To This Cryptocurrency Exchange in March 2026" } ], "confidence": 0.75, "story_ids": [ "google_news:article:89ab9f7cb2d13f27", "google_news:article:3d33e3ed620ffab4", "google_news:article:c6afc62863eaa274", "google_news:article:f14f86265554c67d", "google_news:article:9cc189a82433747e", "google_news:article:a801527685cda78b", "google_news:article:82f1e804e3686b53", "google_news:article:e5cb2b553f864f17", "rss:cryptoslate.com_feed_:e00e17dcb1309d6a", "google_news:article:9cbb8bc3bc1d8e74", "rss:decrypt.co_feed:cddc6f0758f62d7f", "rss:bitcoinmagazine.com_.rss_full_:fbcd2f4d7ed70645", "rss:www.coindesk.com_arc_outboundfeeds_rss_:e80ee3c43bd7988c", "rss:www.coindesk.com_arc_outboundfeeds_rss_:fa1f60ca3aaecf67", "rss:thedefiant.io_api_feed:557e6ec8462c75a4", "rss:protos.com_feed_:5fd13745f96430af", "google_news:article:9ac905cb2038d80f", "google_news:article:262f10f3234c39fb", "google_news:article:6ad932b5ac521339", "rss:cryptoslate.com_feed_:c24c9475da654523", "rss:cointelegraph.com_rss:6b7fe47cd22aa387", "google_news:article:fad9284487081e04", "rss:cryptoslate.com_feed_:6f3398d1e55dae5a", "google_news:article:4316c124812c81b7", "rss:cointelegraph.com_rss:b0d5ed2476375a5b", "google_news:article:0d75dc8ccd650796", "google_news:article:f705ea62de42a519" ], "sources": [ { "url": "https://news.google.com/rss/articles/CBMiX0FVX3lxTE1mTzA3Y1VXT3FIQmZuLTlQMVJwWC1tWWpaVm1EM2pyQzdmUGZ3SlBpaWF3Vm9MVXhwT3h1WVdrLUk5Y2NwdEh3TXlISHB0cWVUNVNMQ2V6R01scHlXUmxB?oc=5", "label": "shattered.io", "source_type": "google_news", "official": false }, { "url": "https://news.google.com/rss/articles/CBMifEFVX3lxTFBqYnZUdkpmeXl5T3Q4aWdmcW1xZkJtYVotc1lWa2V3eXNPRThjdjlteFZrVEVEazNwREpkaVozRnFMaE5IeTA2N0NMT2stN0V2QVpqbjQ1VS1XWWF4Y1IwRWJCX1ZXU0JBUW8yUUQ2M2xSbG0wOGEwQnhFVUI?oc=5", "label": "The Cryptonomist", "source_type": "google_news", "official": false }, { "url": "https://news.google.com/rss/articles/CBMiigFBVV95cUxNUW5QZVQxVWFaWU1PTmxQVk9ZdjBXM3l5Y1hLMlJBUkZSU1UxWXBVWm5SZ00xcTJFRXFXcmxRWFF3MG9pT1g1WkU3cmdkX2g1VmZfZEhIUm1vV3JQRVFZWWdTMzhpVW9MaUJHOHRGOFEtMWlCRXJPV3lNaDJSdURyN1JvaUNfZEpIQXc?oc=5", "label": "Pluang", "source_type": "google_news", "official": false }, { "url": "https://news.google.com/rss/articles/CBMid0FVX3lxTE5sVTd5SEUxTS10d2hIMjlWbEM1emxSNFltdVBidi14T1JBeGdBaUxEdkFIbUUwY1lDaVFpMk9NUWNkRTZxaHNjTmdoUVBrNDRfZTZqS3R2SElCRDhLaTBoLU1na1hOSU9jTzdKc1FvdTB1UXRTbTFr?oc=5", "label": "Substack", "source_type": "google_news", "official": false }, { "url": "https://news.google.com/rss/articles/CBMixwFBVV95cUxOVkhabVNGM01QTmxOS0RjczZDSFlRSkdIc2h1QzBadi00WE82cU9GZ2NjS1FZLWVSenVPUGNENjFwNE1UQ0xQWjV4SkFqckZPSE8xLTVEamJVM01GczFRckFUamc5NnRFeW1hUFhoalJ0N0JyLVpvTmxEMzRXUTVZanc5SXNmSXlfUmo2RUZiSDJQSENjektvNFBURURhbVBBUUJzX193TkRnZ2FsQlVnWkZrdVJPQmhGSjRaRW5WNzBfajlWVEln?oc=5", "label": "TradingView", "source_type": "google_news", "official": false }, { "url": "https://news.google.com/rss/articles/CBMiogFBVV95cUxNOGpVUU4ydnk1VHcyaGxURWEzWVVBNGwxYlhod0gxalJ4UjBtTUtjdUU3SnJJdWFmd3NOVDVKSmV4bVhXSnNwX2RfNjc0ZzNVbzRWSVFEUGdVMDdTNlRHSjhpN0FycldkMXYxWFlzSFFLd2dtZXJDblczTW02cXktanNIREIzSzFYTFpCZEtSSVFsaHlYNE1oZ1dXRDZWeldfRHfSAacBQVVfeXFMUFBiU1hCOTRwM0RGUGN2aU5wUlpSRlZqVFhRRTZGZmswWV9palZseW1ZZWZFTjhPN25WMUtvc3NSYk1kaDA1QldUdGVURzNwd0xZMnhMd1JnamxFMXpndkJXNlk5VHJ2aEM0b2lJQjVNUm5EcS13UzJtWXNpZmoxZmZDNGwtdVlxZnNQSjhYSDZnY2ZoeXBuUFB5RWxtMFZ0QVBodkJXNE0?oc=5", "label": "CNBC", "source_type": "google_news", "official": false }, { "url": "https://news.google.com/rss/articles/CBMidEFVX3lxTE55ZS10SS1SWTZRQUNYTXM0UFI1V0VjMnAtcHc2RUthLXowRnQyUHZiWURHQ0dleFpRQmJYQVJQZ25wRDljVHpBVW12eTRRcEs5eFFOTlozeWw1Y1hFb3dZYjdlaFdsSEpLMmNNaFRhalBuYVV5?oc=5", "label": "Substack", "source_type": "google_news", "official": false }, { "url": "https://news.google.com/rss/articles/CBMijwFBVV95cUxOUWp4WWhqS1FuZVc4RU5iU0RQYVp4dnBNNHNxRy1zOEVfZEdTRXF4d19WU0F2Wmh1WXhQSHVScXZabnFpNXNhRW9hdW9RYUpGeDF0RUpDLVNDaUtPa29ENEo4Y3VqN1plWC1QM0dQdTdSc2FfWFkzNExCWk5aY1ZLZjJnY3FYSHVva28wMUxkQQ?oc=5", "label": "The Tech Buzz", "source_type": "google_news", "official": false }, { "url": "https://cryptoslate.com/bitgets-north-korea-linked-352-million-hack-could-drain-76-of-its-protection-fund/", "label": "CryptoSlate", "source_type": "rss", "official": false }, { "url": "https://news.google.com/rss/articles/CBMidEFVX3lxTE1EV3FrOF93aHlJWi1BVGlCdG5McmJNNVBSd08waEJmcVNjZ2RDOVd0LTBCa2M1VktsQnl6YTNzcDBKSGRSYk1hOVFUZzA2Rm1YdXdqSEU0cjIxZFdDZTlkZkVWTXBRWEd5S1hGb3l2Q19pdk15?oc=5", "label": "tech-insider.org", "source_type": "google_news", "official": false }, { "url": "https://decrypt.co/379350/bitget-hack-387m-what-happened-why-north-korea-suspect", "label": "Decrypt", "source_type": "rss", "official": false }, { "url": "https://bitcoinmagazine.com/news/north-korea-linked-to-bitget-hack", "label": "Bitcoin Magazine", "source_type": "rss", "official": false }, { "url": "https://www.coindesk.com/markets/2026/09/25/bitget-s-usd351-million-hack-happened-via-spoofed-transfers-not-private-keys-ceo-gray-chen-says", "label": "CoinDesk", "source_type": "rss", "official": false }, { "url": "https://www.coindesk.com/markets/2026/09/25/circle-and-tether-step-in-to-freeze-hacker-wallet-after-massive-bitget-crypto-heist", "label": "CoinDesk", "source_type": "rss", "official": false }, { "url": "https://thedefiant.io/news/hacks/bitget-raises-hack-estimate-to-387-5-million-as-token-accounting-widens", "label": "The Defiant", "source_type": "rss", "official": false }, { "url": "https://protos.com/bitgets-eighth-birthday-ends-with-a-352m-hack/", "label": "Protos", "source_type": "rss", "official": false }, { "url": "https://news.google.com/rss/articles/CBMiZEFVX3lxTE92RUFSckc4dU5iampCa1RndGdubTYxZ0h0ZjJfc2J2clRKcF9QNjZJZmYxLWFkOTFvZmhJMFVicVVEOG9KRHhYM3ZBdWdxdjMzbXNKUWJOOFJ5UTRsUC1yY1puQlo?oc=5", "label": "Binance", "source_type": "google_news", "official": false }, { "url": "https://news.google.com/rss/articles/CBMiW0FVX3lxTFBkZ3JPUnlfQ2FSMXpnWG5hMEZCNmZ3bDF2QmVYOXJSeFlSTDNiVk5McEVlQXU5M002ZWQwS1poZkkwRTZ0Uld2ZFJHWjlvbVBkMTFvNWdRN0NuSTQ?oc=5", "label": "tokenpost.com", "source_type": "google_news", "official": false }, { "url": "https://news.google.com/rss/articles/CBMifkFVX3lxTE9nTlhxSWJjY0lnd01pd2VBeHRFOWxZalBnV0VkY3JTMzRzX21LQ3pWNUxoYlpTYUUyN2J0ZWUzMTlKbnlMZkExZjJGTmRtUFEtRXRRaHlYa2llS25lV0pyLVNhaFFUYUVIOG9MT1ViZk4wVGxpa1k1dnIyWDhwZw?oc=5", "label": "Coinfomania", "source_type": "google_news", "official": false }, { "url": "https://cryptoslate.com/bitgets-hack-just-got-36-million-bigger-and-now-theres-a-bounty-on-the-stolen-crypto/", "label": "CryptoSlate", "source_type": "rss", "official": false }, { "url": "https://cointelegraph.com/news/bitget-clarifies-assets-affected-security-breach?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound", "label": "Cointelegraph", "source_type": "rss", "official": false }, { "url": "https://news.google.com/rss/articles/CBMipAFBVV95cUxObjZlUzRua2tjVXczTHVlNU9FUXNiaXRRRmJTN0ZTdjJqdmMtYlp4Nlo4c2o4TDVHVUpONUVqUXFLZzlVMTBXS29DNElZU251bk5ySDQ5dE0tV0t0UmFLblMzUm1KR1NpYy1pTmRIWkJyR2EwdW1mXzJEZllVallFa0JNZ25tWWdXREJzZkFIdE5wWVlGU0RHWmpSaWY3d2t0b0ZEVw?oc=5", "label": "Pluang", "source_type": "google_news", "official": false }, { "url": "https://cryptoslate.com/swiss-bank-shields-bitget-institutions-while-retail-funds-freeze/", "label": "CryptoSlate", "source_type": "rss", "official": false }, { "url": "https://news.google.com/rss/articles/CBMitwFBVV95cUxNdWlDYmVHOEJ5NTMtT1ZldlZRUElXdXl0Y0JadkVXVG5LNk1iYnE2OTBaNW1rNHRxSkFpa3RUelRsNnJHdHFwWkxUeU4yaWVnallHM21OR2tobWYtS2hoZmczTWtzUENTSnQzeGRWNExlUnNiQ3VDX1piS0IwWDZ0Y21VTU1RM3NwaUJVM0J6RVFubmd2N0xzWHlCSXUtZzNSMV9kMmJPTm1JaElHZzdnRlliMlVQTUU?oc=5", "label": "The American Bazaar", "source_type": "google_news", "official": false }, { "url": "https://cointelegraph.com/news/bitget-btc-withdrawal-hacker-eth-swap-thorchain?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound", "label": "Cointelegraph", "source_type": "rss", "official": false }, { "url": "https://news.google.com/rss/articles/CBMiggFBVV95cUxPSGpMNWdMWUFzVUUwZmFad0JqMFRhdERZcy1KdzR1WkZLb0NVM3RxazdpeTlaenlKaVhGYUY0VHdsSkg0dllBRE5EUzVnLTl5OXhRSFVXcUpTZHBySmdyNE9sMGs4QTgxNElkZlZzWkhFMzl1ckhYbklaeF9WU3ByeWt3?oc=5", "label": "Hokanews", "source_type": "google_news", "official": false }, { "url": "https://news.google.com/rss/articles/CBMi4wFBVV95cUxQN0hkdEZsSHd5QUg2UlYwbERYdWNVc1ZwVk5iUnBfYjY4Y3lzR0ozY2ZKNlhSTm5BTXRCYVo5UFZHX3hZbWpxWVFhRkFWVVVjYWE0bTNKYjBRdEtOMEFnajFRbUNxNktTTm05S21KQzUzajdMdUlDTjNpTFpySlVxNTFHMGN2ODd1dElSX0x3WklJaDVFZjFhNjd5VWJPaElVZTgxVnhCRzZWb210a3ZXc3NkbWY0TlJLZ3N4MTYzU3V3TjdhU0syRkxkeWxxSlh5SFNDUmx2WjhEWDJDUUNUN19xbw?oc=5", "label": "24/7 Wall St.", "source_type": "google_news", "official": false } ] }, { "update_id": "upd_ae4fb24936bbb9c7", "event_id": "evt_6655595dc1e36e0b", "occurred_at": "2026-09-25T11:28:43Z", "published_at": "2026-09-25T11:28:43Z", "first_seen_at": "2026-09-25T17:25:10.222324Z", "time_precision": "published", "update_type": "escalation", "material_change": true, "title_zh": "3.51亿美元不翼而飞……黑客已在转移资金！- Binance", "title_en": "$351M GONE… AND THE HACKER IS ALREADY SWAPPING IT! - Binance", "what_changed_zh": "据报道，一起黑客攻击导致3.51亿美元被盗，攻击者已在转移被盗资金。", "what_changed_en": "$351M has reportedly been stolen in a hack, and the attacker is already swapping the stolen funds.", "current_state_zh": "据报道，一起黑客攻击导致3.51亿美元被盗，攻击者已在转移被盗资金。", "current_state_en": "$351M has reportedly been stolen in a hack, and the attacker is already swapping the stolen funds.", "detailed_summary_zh": "$351M has reportedly been stolen in a hack, and the attacker is already swapping the stolen funds.", "detailed_summary_en": "$351M has reportedly been stolen in a hack, and the attacker is already swapping the stolen funds.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.0, "references": [], "confidence": 0.75, "story_ids": [ "google_news:article:92a7ffb368c7b35f" ], "sources": [ { "url": "https://news.google.com/rss/articles/CBMiaEFVX3lxTE5wN1MxWnBQOUZwOU9IcDdZZS1mVGYyMUc5SzRCY0dqRDhkUnFxUjNYYWh0X2lMeGU2ZFVPRjhWcWhRUTVaZ2JxY1ZSLWdnRS1SamVwUUswMkRZa2tuc3B3ZWxMN00xTnpf?oc=5", "label": "Binance", "source_type": "google_news", "official": false } ] }, { "update_id": "upd_f3386a920595f5a0", "event_id": "evt_6655595dc1e36e0b", "occurred_at": "2026-09-25T18:42:51Z", "published_at": "2026-09-25T18:42:51Z", "first_seen_at": "2026-09-25T23:24:24.062734Z", "time_precision": "published", "update_type": "response", "material_change": true, "title_zh": "Circle与Tether冻结与Bitget黑客事件相关的稳定币——但大部分资金已溜走", "title_en": "Circle and Tether Freeze Stablecoins Tied to Bitget Hack—But Most Funds Slip Away", "what_changed_zh": "Circle与Tether冻结了与Bitget约3.87亿美元黑客事件相关的约31.8万美元USDC和USDT，而攻击者的约170枚ETH及其他攻击者持有的ETH仍处于发行方无法触及的范围之外。", "what_changed_en": "Circle and Tether froze roughly $318,000 in USDC and USDT tied to the ~$387 million Bitget hack, while the attacker's ~170 ETH and other exploiter-held ETH remained beyond the issuers' reach.", "current_state_zh": "Circle与Tether冻结了与Bitget约3.87亿美元黑客事件相关的约31.8万美元USDC和USDT，而攻击者的约170枚ETH及其他攻击者持有的ETH仍处于发行方无法触及的范围之外。", "current_state_en": "Circle and Tether froze roughly $318,000 in USDC and USDT tied to the ~$387 million Bitget hack, while the attacker's ~170 ETH and other exploiter-held ETH remained beyond the issuers' reach.", "detailed_summary_zh": "Circle and Tether froze roughly $318,000 in USDC and USDT tied to the ~$387 million Bitget hack, while the attacker's ~170 ETH and other exploiter-held ETH remained beyond the issuers' reach.", "detailed_summary_en": "Circle and Tether froze roughly $318,000 in USDC and USDT tied to the ~$387 million Bitget hack, while the attacker's ~170 ETH and other exploiter-held ETH remained beyond the issuers' reach.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.5, "references": [], "confidence": 0.75, "story_ids": [ "rss:decrypt.co_feed:a4071d1f0881e3d5" ], "sources": [ { "url": "https://decrypt.co/379365/circle-tether-freeze-stablecoins-bitget-hack", "label": "Decrypt", "source_type": "rss", "official": false } ] }, { "update_id": "upd_62c36e9024283ea2", "event_id": "evt_6655595dc1e36e0b", "occurred_at": "2026-09-26T12:56:41Z", "published_at": "2026-09-26T12:56:41Z", "first_seen_at": "2026-09-26T16:34:44.876459Z", "time_precision": "published", "update_type": "escalation", "material_change": true, "title_zh": "Bitget黑客转移8300万美元被盗XRP，Ripple无法冻结", "title_en": "Bitget hacker moves $83 million in stolen XRP that Ripple cannot freeze", "what_changed_zh": "Bitget 3.875亿美元漏洞背后的攻击者从三个持有钱包中转移了约8300万美元被盗XRP，剩余约7500万美元留在根据XRP Ledger规则无法冻结的账户中，而Bitget表示其保护基金覆盖损失，分阶段提现将从9月28日持续至10月2日恢复。", "what_changed_en": "The attacker behind Bitget's $387.5M breach drained about $83M of stolen XRP from three holding wallets, leaving roughly $75M in accounts that cannot be frozen under the XRP Ledger's rules, while Bitget said its protection fund covers losses and staged withdrawals resume Sept. 28 through Oct. 2.", "current_state_zh": "Bitget 3.875亿美元漏洞背后的攻击者从三个持有钱包中转移了约8300万美元被盗XRP，剩余约7500万美元留在根据XRP Ledger规则无法冻结的账户中，而Bitget表示其保护基金覆盖损失，分阶段提现将从9月28日持续至10月2日恢复。", "current_state_en": "The attacker behind Bitget's $387.5M breach drained about $83M of stolen XRP from three holding wallets, leaving roughly $75M in accounts that cannot be frozen under the XRP Ledger's rules, while Bitget said its protection fund covers losses and staged withdrawals resume Sept. 28 through Oct. 2.", "detailed_summary_zh": "The attacker behind Bitget's $387.5M breach drained about $83M of stolen XRP from three holding wallets, leaving roughly $75M in accounts that cannot be frozen under the XRP Ledger's rules, while Bitget said its protection fund covers losses and staged withdrawals resume Sept. 28 through Oct. 2.", "detailed_summary_en": "The attacker behind Bitget's $387.5M breach drained about $83M of stolen XRP from three holding wallets, leaving roughly $75M in accounts that cannot be frozen under the XRP Ledger's rules, while Bitget said its protection fund covers losses and staged withdrawals resume Sept. 28 through Oct. 2.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.0, "references": [], "confidence": 0.75, "story_ids": [ "rss:www.coindesk.com_arc_outboundfeeds_rss_:43235257dbaa4f57" ], "sources": [ { "url": "https://www.coindesk.com/markets/2026/09/26/bitget-hacker-moves-usd83-million-in-stolen-xrp-that-ripple-cannot-freeze", "label": "CoinDesk", "source_type": "rss", "official": false } ] }, { "update_id": "upd_8236e70da1deffc8", "event_id": "evt_6655595dc1e36e0b", "occurred_at": "2026-09-27T02:01:44Z", "published_at": "2026-09-27T02:01:44Z", "first_seen_at": "2026-09-27T10:07:41.220228Z", "time_precision": "published", "update_type": "response", "material_change": true, "title_zh": "THORChain在漏洞事件余波中拒绝封锁Bitget地址的请求 - Intellectia AI", "title_en": "THORChain Rejects Request to Block Bitget Addresses Amid Exploit Fallout - Intellectia AI", "what_changed_zh": "THORChain在漏洞事件后拒绝了封锁Bitget相关地址的请求，该网络的决定凸显了其拒绝应交易所或第三方要求审查交易的立场。", "what_changed_en": "THORChain rejected a request to block Bitget-related addresses in the wake of an exploit, with the network's decision highlighting its refusal to censor transactions at the request of an exchange or third party.", "current_state_zh": "THORChain在漏洞事件后拒绝了封锁Bitget相关地址的请求，该网络的决定凸显了其拒绝应交易所或第三方要求审查交易的立场。", "current_state_en": "THORChain rejected a request to block Bitget-related addresses in the wake of an exploit, with the network's decision highlighting its refusal to censor transactions at the request of an exchange or third party.", "detailed_summary_zh": "THORChain rejected a request to block Bitget-related addresses in the wake of an exploit, with the network's decision highlighting its refusal to censor transactions at the request of an exchange or third party.", "detailed_summary_en": "THORChain rejected a request to block Bitget-related addresses in the wake of an exploit, with the network's decision highlighting its refusal to censor transactions at the request of an exchange or third party.", "background_zh": "THORChain 是一个去中心化跨链流动性协议，允许在不同区块链之间直接兑换数字资产，无需依赖中心化交易所。其官方 FAQ 称，该协议没有中心化治理机构或 DAO，协议升级由开发者社区提出并协调，节点参与其中。Bitget 成立于 2018 年，是一家中心化加密货币交易所。", "background_en": "THORChain is a decentralized cross-chain liquidity protocol that enables swaps of digital assets across different blockchains without relying on centralized exchanges. According to its FAQ, it has no central governance body or DAO, with protocol upgrades proposed and coordinated by the developer community and node operators. Bitget, founded in 2018, is a centralized cryptocurrency exchange.", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "最直接的敞口是 THORChain 的原生代币 RUNE 及其跨链兑换活动，因为拒绝配合交易所的冻结请求可能影响中心化交易所及其用户通过此类渠道转移资金的方式。该争议也会使 THORChain 上的 XRP 与 BTC 交易对受到更多关注，但这属于治理与合规层面的问题，而非全市场性事件。", "market_impact_en": "The most direct exposure is THORChain’s RUNE token and its cross-chain swap activity, since a refusal to honor exchange freeze requests can affect how centralized exchanges and their users route funds through such venues. The dispute also draws scrutiny to XRP and BTC pairs on THORChain, though it is a governance and compliance question rather than a market-wide event.", "importance_score": 7.5, "references": [ { "url": "https://thorchain.org/faq", "title": "THORChain FAQ | Answers About Swaps, RUNE, TCY & How..." }, { "url": "https://en.wikipedia.org/wiki/Bitget", "title": "Bitget - Wikipedia" }, { "url": "https://thorchain.org/", "title": "THORChain" } ], "confidence": 0.75, "story_ids": [ "google_news:article:c0c03f97c613eba8", "google_news:article:672982a9a96fc5c8", "rss:thedefiant.io_api_feed:8f434300f2842773" ], "sources": [ { "url": "https://news.google.com/rss/articles/CBMiqwFBVV95cUxQLW43Ykg5azBxRjRMRHl0Snd4bjZ2ZWhQZ3Q1OUkwdkt6RlpZTlkyel9rUzJPckhVVzdMNzF5SkZlaXlBb3A2ZVNxcl9icjhOb054SW10ZUxTTnBNdXRLeGJ2cl9xamEzbHh5YmxYYVJSeEx6ZEpEZW92aEhoQ04yZ2pDZnhiX1pFdDM4N0Z1cFF2NW5LaC13MDJvQ1FZcGJhY3hJVWVsSEFnUHc?oc=5", "label": "Intellectia AI", "source_type": "google_news", "official": false }, { "url": "https://news.google.com/rss/articles/CBMickFVX3lxTE1tSmN1OTZFcXN5UGhUQ2p0WXotckFzQXdPODB5VWdGbWtJM1NxdTNHU05BSjNYNkdsOUQ1a3BJeFRmckRXOFpjQmNYaEx1RUhsLVpxVzJ4ZGdlSDZjaW9HSURuQ1VhbDdLOXhJcW81QUtNUQ?oc=5", "label": "BeInCrypto", "source_type": "google_news", "official": false }, { "url": "https://thedefiant.io/news/defi/thorchain-pushes-back-on-bitget-s-demand-to-block-hacker-addresses", "label": "The Defiant", "source_type": "rss", "official": false } ] }, { "update_id": "upd_fa0e89935cbeab68", "event_id": "evt_6655595dc1e36e0b", "occurred_at": "2026-09-27T17:00:42Z", "published_at": "2026-09-27T17:00:42Z", "first_seen_at": "2026-09-27T17:08:08.125264Z", "time_precision": "published", "update_type": "escalation", "material_change": true, "title_zh": "2700万枚被盗代币转移之际，Bitget冻结XRP提现", "title_en": "Bitget freezes XRP withdrawals as 27M stolen tokens move", "what_changed_zh": "截至9月26日，Bitget的XRP提现通道仍处于关闭状态，按交易所公布的漏洞事件后提现恢复时间表，XRP被归入10月2日08:00 UTC的最后一批。Bitquery表示，截至9月26日02:54 UTC，已有2763万枚被盗XRP从两个被追踪的攻击者账户转出，其追踪的六个账户中仍留有7535万枚XRP。\n\n对Bitget上的XRP持有者而言，交易仍可进行，但在10月2日的计划阶段开放前，无法将XRP提至外部XRP Ledger地址。被盗代币的持续转移则关系到赃款是否正在被进一步分散。\n\nBitget的提现恢复分阶段进行：9月28日为BTC，9月29日为ETH，9月30日为USDT，10月2日则覆盖“其他代币”、法币及点对点服务；XRP未被单独列出。该交易所表示已查明并修复了9月24日事件涉及的漏洞，用户余额未受影响，交易和充值仍在继续。", "what_changed_en": "Bitget left XRP withdrawals disabled as it scheduled its final post-breach withdrawal reopening phase for Oct. 2, while Bitquery traced 27.63 million stolen XRP moving onward from two tracked accounts.", "current_state_zh": "截至9月26日，Bitget的XRP提现通道仍处于关闭状态，按交易所公布的漏洞事件后提现恢复时间表，XRP被归入10月2日08:00 UTC的最后一批。Bitquery表示，截至9月26日02:54 UTC，已有2763万枚被盗XRP从两个被追踪的攻击者账户转出，其追踪的六个账户中仍留有7535万枚XRP。\n\n对Bitget上的XRP持有者而言，交易仍可进行，但在10月2日的计划阶段开放前，无法将XRP提至外部XRP Ledger地址。被盗代币的持续转移则关系到赃款是否正在被进一步分散。\n\nBitget的提现恢复分阶段进行：9月28日为BTC，9月29日为ETH，9月30日为USDT，10月2日则覆盖“其他代币”、法币及点对点服务；XRP未被单独列出。该交易所表示已查明并修复了9月24日事件涉及的漏洞，用户余额未受影响，交易和充值仍在继续。", "current_state_en": "Bitget left XRP withdrawals disabled as it scheduled its final post-breach withdrawal reopening phase for Oct. 2, while Bitquery traced 27.63 million stolen XRP moving onward from two tracked accounts.", "detailed_summary_zh": "Bitget left XRP withdrawals disabled as it scheduled its final post-breach withdrawal reopening phase for Oct. 2, while Bitquery traced 27.63 million stolen XRP moving onward from two tracked accounts.", "detailed_summary_en": "Bitget left XRP withdrawals disabled as it scheduled its final post-breach withdrawal reopening phase for Oct. 2, while Bitquery traced 27.63 million stolen XRP moving onward from two tracked accounts.", "background_zh": "该事件发生在9月24日，未经授权的转账波及Bitget的热钱包和温钱包基础设施；Bitget称损失约3.516亿美元，另有报道称此次入侵涉及3.875亿美元。Bitquery估算从该交易所被盗的XRP约为1.0298亿枚，相关报道指出原生XRP无法在XRP Ledger协议层面被冻结，这限制了追回手段。Bitquery追踪到外流的XRP经由新账户流向跨链兑换网络THORChain，并称其能追踪到的资金大部分被兑换为比特币。", "background_en": "The incident dates to Sept. 24, when unauthorized transfers affected Bitget's hot and warm wallet infrastructure; Bitget has described the loss as approximately $351.6 million, while other reports put the breach at $387.5 million. Bitquery estimates about 102.98 million XRP was taken from the exchange, and reporting notes that native XRP cannot be frozen at the XRP Ledger protocol level, limiting recovery options. Bitquery followed outgoing XRP through new accounts toward the cross-chain swap network THORChain, saying most of the flow it could follow was being swapped toward Bitcoin.", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "在Bitget上，XRP仍可交易，但无法提至外部XRP Ledger地址，因此持有者将XRP转出该平台的能力取决于交易所的恢复时间表。Bitquery的追踪显示，被盗XRP经由THORChain流转并大部分被兑换为比特币，这是一条跨链流动性通道；但该追踪并不能证明发生了XRP现货抛售，因此并不直接反映订单簿层面的抛压。", "market_impact_en": "On Bitget, XRP can still be traded but not withdrawn to external XRP Ledger addresses, so holders' ability to move XRP off the venue is tied to the exchange's reopening timetable. Bitquery's tracing shows stolen XRP routed through THORChain and largely swapped toward Bitcoin — a cross-chain liquidity channel — but the trace does not establish spot XRP sales, so it is not a direct measure of order-book pressure.", "importance_score": 7.5, "references": [ { "url": "https://www.coindesk.com/markets/2026/09/26/bitget-hacker-moves-usd83-million-in-stolen-xrp-that-ripple-cannot-freeze", "title": "Bitget hacker moves $83 million in stolen XRP that Ripple cannot freeze" }, { "url": "https://financefeeds.com/bitget-hacker-moves-83m-in-xrp-as-network-rules-limit-recovery/", "title": "Bitget Hacker Moves $83M of Stolen XRP; $75M Still Parked" }, { "url": "https://www.ccn.com/news/crypto/bitget-hack-xrp-eth-351-million-withdrawals/", "title": "XRP and ETH Lead $351.6M Bitget Wallet Breach as Withdrawals Remain Paused" } ], "confidence": 0.75, "story_ids": [ "rss:cryptoslate.com_feed_:d018c92454693b96" ], "sources": [ { "url": "https://cryptoslate.com/bitget-freezes-xrp-withdrawals-as-27m-stolen-tokens-move/", "label": "CryptoSlate", "source_type": "rss", "official": false } ] }, { "update_id": "upd_f5b864a3c22ed76d", "event_id": "evt_6655595dc1e36e0b", "occurred_at": "2026-09-27T18:15:00Z", "published_at": "2026-09-27T18:15:00Z", "first_seen_at": "2026-09-28T01:56:44.154962Z", "time_precision": "published", "update_type": "escalation", "material_change": true, "title_zh": "GoPlus质疑THORChain的去中心化说法，此前Bitget黑客事件中约8000万美元XRP发生转移 - finance.biggo.com", "title_en": "GoPlus Challenges THORChain's Decentralization Claims Amid $80 Million XRP Movement From Bitget Hack - finance.biggo.com", "what_changed_zh": "GoPlus在追踪与Bitget黑客事件相关的约8000万美元XRP时，对THORChain的去中心化说法提出质疑。", "what_changed_en": "GoPlus pushed back on THORChain's decentralization claims while tracing about $80 million in XRP tied to the Bitget hack.", "current_state_zh": "GoPlus在追踪与Bitget黑客事件相关的约8000万美元XRP时，对THORChain的去中心化说法提出质疑。", "current_state_en": "GoPlus pushed back on THORChain's decentralization claims while tracing about $80 million in XRP tied to the Bitget hack.", "detailed_summary_zh": "GoPlus pushed back on THORChain's decentralization claims while tracing about $80 million in XRP tied to the Bitget hack.", "detailed_summary_en": "GoPlus pushed back on THORChain's decentralization claims while tracing about $80 million in XRP tied to the Bitget hack.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 7.0, "references": [], "confidence": 0.75, "story_ids": [ "google_news:article:395305eed7229529" ], "sources": [ { "url": "https://news.google.com/rss/articles/CBMidkFVX3lxTE9XeHg3N1VkQzE3SDVRakZhS0JFVTRnX1lyX3RnQVZYellwalE5X19Raml5dF9FS0xxZ1hIOFpZSG9fS0NnRlRXOW0xdWNmR0RGZXpuZ0JIVlNPb2RFbEVSTmNNY1lTLWZRMWdkVmlSYjZMQzdWT0E?oc=5", "label": "finance.biggo.com", "source_type": "google_news", "official": false } ] }, { "update_id": "upd_95bb1ef694726420", "event_id": "evt_6655595dc1e36e0b", "occurred_at": "2026-09-28T01:48:02Z", "published_at": "2026-09-28T01:48:02Z", "first_seen_at": "2026-09-28T11:07:58.977712Z", "time_precision": "published", "update_type": "remediation", "material_change": true, "title_zh": "加密早报：Upbit L2项目GIWA发布官方澄清，Bitget将逐步恢复提现", "title_en": "Crypto Morning Brief: Upbit L2 Project GIWA Issues Official Clarification, Bitget to Gradually Resume Withdrawals", "what_changed_zh": "据加密早报，Upbit的L2项目GIWA发布官方澄清，Bitget宣布将逐步恢复提现。", "what_changed_en": "Upbit's L2 project GIWA issued an official clarification and Bitget announced it will gradually resume withdrawals, according to a crypto morning brief.", "current_state_zh": "据加密早报，Upbit的L2项目GIWA发布官方澄清，Bitget宣布将逐步恢复提现。", "current_state_en": "Upbit's L2 project GIWA issued an official clarification and Bitget announced it will gradually resume withdrawals, according to a crypto morning brief.", "detailed_summary_zh": "Upbit's L2 project GIWA issued an official clarification and Bitget announced it will gradually resume withdrawals, according to a crypto morning brief.", "detailed_summary_en": "Upbit's L2 project GIWA issued an official clarification and Bitget announced it will gradually resume withdrawals, according to a crypto morning brief.", "background_zh": "Bitget 在一起约3.5亿美元加密货币被盗的黑客事件后冻结了客户提现；首席执行官 Gracy Chen 表示冷钱包完全安全，受影响的只有热钱包。交易所随后称，此次事件涉及其钱包基础设施中的关键后端系统，攻击者利用第三方产品的漏洞获取内部凭证，并用其提交绕过风控的欺诈性提现指令，相关漏洞已在恢复提现前修复。链上调查员 ZachXBT 表示，中国非法行为者正代其称为疑似与朝鲜有关的黑客清洗赃款，通过跨链转移把资金存入包括 Wasabi 在内的混币服务；这一活动使 THORChain 卷入争议——当赃款流经其系统时，无需许可的基础设施是否应当介入，而 THORChain 表示不会选择性地封锁钱包或 swap。", "background_en": "Bitget froze customer withdrawals after a hack in which roughly $350 million in crypto was stolen; CEO Gracy Chen said cold wallets remained fully secure and that only hot wallets were affected. The exchange has since said the incident involved a critical backend system in its wallet infrastructure, that attackers exploited vulnerabilities in third-party products to obtain internal credentials used to submit fraudulent withdrawal instructions, and that it remediated the vulnerability before withdrawals returned. Blockchain investigator ZachXBT said Chinese illicit actors were laundering proceeds on behalf of hackers he described as allegedly linked to North Korea, chain-hopping funds into mixing services including Wasabi; the activity has put THORChain at the center of a dispute over whether permissionless infrastructure should intervene when stolen assets pass through its systems, with THORChain saying it will not selectively block wallets or swaps.", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "约4642枚被追踪的交易所持仓比特币流出单一平台，会收紧该平台上 BTC 的现货流动性，并在交易者关注是否出现更多提现或风险外溢时，成为其他中心化交易所资产信心的可见信号。跨链桥、混币服务和 THORChain 构成的清洗路径，也持续给处理这些资金的协议与中介带来追回与合规压力；Bitget 则表示客户不会承担损失，其保护基金将覆盖缺口，并计划在一周内以自有资金将其补充至3亿美元以上。", "market_impact_en": "Roughly 4,642 BTC of tracked exchange-held bitcoin leaving a single venue tightens on-venue spot liquidity for BTC and is a visible confidence signal for other centralized-exchange assets as traders watch for further withdrawals or contagion. The laundering chain — bridges, mixers and THORChain — keeps recovery and compliance pressure on the protocols and intermediaries handling those flows, even as Bitget says user losses will be covered by its Protection Fund, which it plans to replenish above $300 million within a week.", "importance_score": 9.0, "references": [ { "url": "https://www.reuters.com/legal/government/crypto-exchange-bitget-pauses-withdrawals-after-350-million-stolen-hack-2026-09-25/", "title": "Crypto exchange Bitget pauses withdrawals after $350 million ..." }, { "url": "https://decrypt.co/379275/bitget-hack-183-million-crypto-exchange-wallets", "title": "Bitget Hacked as $350 Million Vanishes From Crypto Exchange ..." }, { "url": "https://defillama.com/cexs", "title": "Crypto Exchange Reserves and Inflows - DefiLlama" } ], "confidence": 0.75, "story_ids": [ "google_news:article:3d9255dfbcc29458", "rss:thedefiant.io_api_feed:3fe49d78f4a9ca18", "rss:cryptoslate.com_feed_:60dbbab8f61b8b35", "rss:cryptoslate.com_feed_:315e3f6485e3c68f" ], "sources": [ { "url": "https://www.techflowpost.com/en-US/article/34252", "label": "深潮TechFlow", "source_type": "google_news", "official": false }, { "url": "https://thedefiant.io/news/hacks/bitget-reopens-bitcoin-withdrawals-after-387-5-million-breach", "label": "The Defiant", "source_type": "rss", "official": false }, { "url": "https://cryptoslate.com/bitget-says-bitcoin-withdrawals-open-after-hack/", "label": "CryptoSlate", "source_type": "rss", "official": false }, { "url": "https://cryptoslate.com/nearly-5000-btc-leaves-bitget-as-hackers-begin-laundering-387-million-haul/", "label": "CryptoSlate", "source_type": "rss", "official": false } ] }, { "update_id": "upd_b2414fea77f7cf6c", "event_id": "evt_6655595dc1e36e0b", "occurred_at": "2026-09-28T12:13:09Z", "published_at": "2026-09-28T12:13:09Z", "first_seen_at": "2026-09-28T19:47:05.163343Z", "time_precision": "published", "update_type": "confirmation", "material_change": true, "title_zh": "THORChain拒绝Bitget封锁黑客的请求，600万美元转移至比特币", "title_en": "THORChain rejects Bitget request to block hacker as $6 million moves to bitcoin", "what_changed_zh": "THORChain拒绝了Bitget提出的将与该交易所3.875亿美元黑客攻击相关地址列入黑名单的请求，尽管CoinDesk追踪到27笔兑换通过该协议将约2390枚ETH（630万美元）转换为75.2枚BTC。", "what_changed_en": "THORChain refused Bitget's request to blacklist addresses tied to the exchange's $387.5M hack, even as CoinDesk traced 27 swaps moving ~2,390 ETH ($6.3M) into 75.2 BTC via the protocol.", "current_state_zh": "THORChain拒绝了Bitget提出的将与该交易所3.875亿美元黑客攻击相关地址列入黑名单的请求，尽管CoinDesk追踪到27笔兑换通过该协议将约2390枚ETH（630万美元）转换为75.2枚BTC。", "current_state_en": "THORChain refused Bitget's request to blacklist addresses tied to the exchange's $387.5M hack, even as CoinDesk traced 27 swaps moving ~2,390 ETH ($6.3M) into 75.2 BTC via the protocol.", "detailed_summary_zh": "THORChain refused Bitget's request to blacklist addresses tied to the exchange's $387.5M hack, even as CoinDesk traced 27 swaps moving ~2,390 ETH ($6.3M) into 75.2 BTC via the protocol.", "detailed_summary_en": "THORChain refused Bitget's request to blacklist addresses tied to the exchange's $387.5M hack, even as CoinDesk traced 27 swaps moving ~2,390 ETH ($6.3M) into 75.2 BTC via the protocol.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 7.5, "references": [], "confidence": 0.75, "story_ids": [ "rss:www.coindesk.com_arc_outboundfeeds_rss_:e18f748a1fe52ceb", "rss:protos.com_feed_:40ad62559997a9eb" ], "sources": [ { "url": "https://www.coindesk.com/tech/2026/09/28/thorchain-rejects-bitget-request-to-block-hacker-as-usd6-million-moves-to-bitcoin", "label": "CoinDesk", "source_type": "rss", "official": false }, { "url": "https://protos.com/thorchain-refuses-to-block-bitget-funds-despite-pausing-after-own-hack/", "label": "Protos", "source_type": "rss", "official": false } ] }, { "update_id": "upd_d91100ebc4f092e1", "event_id": "evt_6655595dc1e36e0b", "occurred_at": "2026-09-28T14:30:12Z", "published_at": "2026-09-28T14:30:12Z", "first_seen_at": "2026-09-28T19:47:18.046337Z", "time_precision": "published", "update_type": "confirmation", "material_change": true, "title_zh": "Bitget只有30分钟来遏制黑客事件，随后2.9亿美元开始转移", "title_en": "Bitget had 30 minutes to contain its hack before $290 million started moving", "what_changed_zh": "Bitget在攻击者从其热钱包转走8760万美元、随后又转走2.028亿美元之前约30分钟检测到未经授权的钱包转账，这意味着3.875亿美元损失中的大部分发生在交易所应急协议触发之后，并引发了对为何被攻破的签名路径仍保持活跃的质疑。", "what_changed_en": "Bitget detected unauthorized wallet transfers about 30 minutes before attackers drained $87.6 million and then $202.8 million from its hot wallets, meaning most of the $387.5 million loss occurred after the exchange's emergency protocols were triggered and raising questions about why the compromised signing route stayed live.", "current_state_zh": "Bitget在攻击者从其热钱包转走8760万美元、随后又转走2.028亿美元之前约30分钟检测到未经授权的钱包转账，这意味着3.875亿美元损失中的大部分发生在交易所应急协议触发之后，并引发了对为何被攻破的签名路径仍保持活跃的质疑。", "current_state_en": "Bitget detected unauthorized wallet transfers about 30 minutes before attackers drained $87.6 million and then $202.8 million from its hot wallets, meaning most of the $387.5 million loss occurred after the exchange's emergency protocols were triggered and raising questions about why the compromised signing route stayed live.", "detailed_summary_zh": "Bitget detected unauthorized wallet transfers about 30 minutes before attackers drained $87.6 million and then $202.8 million from its hot wallets, meaning most of the $387.5 million loss occurred after the exchange's emergency protocols were triggered and raising questions about why the compromised signing route stayed live.", "detailed_summary_en": "Bitget detected unauthorized wallet transfers about 30 minutes before attackers drained $87.6 million and then $202.8 million from its hot wallets, meaning most of the $387.5 million loss occurred after the exchange's emergency protocols were triggered and raising questions about why the compromised signing route stayed live.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.5, "references": [], "confidence": 0.75, "story_ids": [ "rss:cryptoslate.com_feed_:eb380e833fd1410e", "rss:cointelegraph.com_rss:2215a3db81677389" ], "sources": [ { "url": "https://cryptoslate.com/bitget-had-30-minutes-to-contain-its-hack-before-290-million-started-moving/", "label": "CryptoSlate", "source_type": "rss", "official": false }, { "url": "https://cointelegraph.com/news/bitget-388m-hack-third-party-security-vulnerability?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound", "label": "Cointelegraph", "source_type": "rss", "official": false } ] }, { "update_id": "upd_c84471279056a4a6", "event_id": "evt_6655595dc1e36e0b", "occurred_at": "2026-09-29T01:17:49Z", "published_at": "2026-09-29T01:17:49Z", "first_seen_at": "2026-09-29T02:42:26.013713Z", "time_precision": "published", "update_type": "response", "material_change": true, "title_zh": "NEAR Intents称其拦截了与Bitget黑客相关的5000万美元", "title_en": "NEAR Intents says it blocked $50M tied to Bitget hackers", "what_changed_zh": "NEAR Intents 的 SHIELD 系统拦截了超过 5000 万美元与 Bitget 黑客相关的转账尝试，并在执行中冻结了 503,000 美元，约 166,000 美元资金流经；NEAR Intents 表示将放弃 Bitget 提供的赏金。", "what_changed_en": "NEAR Intents' SHIELD system blocked over $50 million in attempted transfers tied to the Bitget hackers, freezing $503,000 mid-execution while about $166,000 passed through; NEAR Intents said it will forego Bitget's bounty.", "current_state_zh": "Circle 和 Tether 冻结了约 318,000 美元与 Bitget 黑客相关的 USDC/USDT；NEAR Intents 的 SHIELD 系统拦截了超过 5000 万美元相关转账并冻结 503,000 美元，约 166,000 美元流经；攻击者持有的 ETH 仍超出部分发行方控制。", "current_state_en": "Circle and Tether froze roughly $318,000 in USDC/USDT tied to the Bitget hack; NEAR Intents' SHIELD system blocked over $50 million in related transfers and froze $503,000, with about $166,000 passing through; attacker-held ETH remained beyond some issuers' reach.", "detailed_summary_zh": "NEAR Intents said its SHIELD system blocked more than $50 million in attempted transfers of funds stolen in the $387.5 million Bitget hack, freezing $503,000 mid-execution while about $166,000 slipped through, as THORChain faced pressure to block the same attacker addresses.", "detailed_summary_en": "NEAR Intents said its SHIELD system blocked more than $50 million in attempted transfers of funds stolen in the $387.5 million Bitget hack, freezing $503,000 mid-execution while about $166,000 slipped through, as THORChain faced pressure to block the same attacker addresses.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.0, "references": [], "confidence": 0.9, "story_ids": [ "rss:cointelegraph.com_rss:75b832e19ffafcc0", "rss:www.coindesk.com_arc_outboundfeeds_rss_:d88866892901aa48", "rss:thedefiant.io_api_feed:48769194557f3156" ], "sources": [ { "url": "https://cointelegraph.com/news/near-intents-says-it-blocked-50m-tied-to-bitget-hackers?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound", "label": "Cointelegraph", "source_type": "rss", "official": false }, { "url": "https://www.coindesk.com/tech/2026/09/29/usd50-million-in-bitget-hacker-swaps-puts-near-intents-permissionless-claim-to-the-test", "label": "CoinDesk", "source_type": "rss", "official": false }, { "url": "https://thedefiant.io/news/hacks/near-intents-says-it-froze-503-000-in-bitget-hack-funds", "label": "The Defiant", "source_type": "rss", "official": false } ] }, { "update_id": "upd_13fae6e04a35281b", "event_id": "evt_6655595dc1e36e0b", "occurred_at": "2026-09-29T02:05:08Z", "published_at": "2026-09-29T02:05:08Z", "first_seen_at": "2026-09-29T10:50:19.314551Z", "time_precision": "published", "update_type": "aftermath", "material_change": true, "title_zh": "【Bitget BTC 保护基金已流出 3215 枚 BTC，价值约 2.66 亿美元】 Foresight News 消息，据 @ai_9684xtpa 监测", "title_en": "【Bitget BTC 保护基金已流出 3215 枚 BTC，价值约 2.66 亿美元】 Foresight News 消息，据 @ai_9684xtpa 监测", "what_changed_zh": "据@ai_9684xtpa监测，Bitget的BTC保护基金已有3215.28枚BTC（约2.66亿美元）流出链上，原本的5500枚BTC仅剩2284.71枚。", "what_changed_en": "Bitget's BTC protection fund has seen 3,215.28 BTC (~$266M) flow out on-chain, leaving 2,284.71 BTC of the original 5,500 BTC, per @ai_9684xtpa monitoring.", "current_state_zh": "据@ai_9684xtpa监测，Bitget的BTC保护基金已有3215.28枚BTC（约2.66亿美元）流出链上，原本的5500枚BTC仅剩2284.71枚。", "current_state_en": "Bitget's BTC protection fund has seen 3,215.28 BTC (~$266M) flow out on-chain, leaving 2,284.71 BTC of the original 5,500 BTC, per @ai_9684xtpa monitoring.", "detailed_summary_zh": "Bitget's BTC protection fund has seen 3,215.28 BTC (~$266M) flow out on-chain, leaving 2,284.71 BTC of the original 5,500 BTC, per @ai_9684xtpa monitoring.", "detailed_summary_en": "Bitget's BTC protection fund has seen 3,215.28 BTC (~$266M) flow out on-chain, leaving 2,284.71 BTC of the original 5,500 BTC, per @ai_9684xtpa monitoring.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 7.0, "references": [], "confidence": 0.75, "story_ids": [ "telegram:foresightnews:119348" ], "sources": [ { "url": "https://foresightnews.pro/news/h5Detail/114200", "label": "foresightnews", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_63779dae4fbed296", "event_id": "evt_6655595dc1e36e0b", "occurred_at": "2026-09-29T16:18:06Z", "published_at": "2026-09-29T16:18:06Z", "first_seen_at": "2026-09-29T18:12:22.499102Z", "time_precision": "published", "update_type": "aftermath", "material_change": true, "title_zh": "Bitget CEO 对从 3.88 亿美元被盗事件中追回资金“不太乐观”", "title_en": "Bitget CEO ‘not very optimistic’ on recovering funds from $388M breach", "what_changed_zh": "Bitget CEO Gracy Chen 表示对冻结或追回此次约3.88亿美元安全事件损失的资金“不太乐观”，并以2025年2月Bybit被盗约15亿美元、最终仅冻结/追回约8000万美元（约3.5%）为参照。Bitget已推出赏金计划，对冻结资金奖励5%、对追回资金奖励5%。NEAR Intents团队称已拦截逾5000万美元与该攻击相关资产并冻结约50万美元；Chen确认Tether和Circle已将与该漏洞相关的钱包列入黑名单，冻结了318,013枚USDT和USDC。提现恢复分阶段进行：周一开始BTC，周二继续ETH。Chen表示朝鲜可能参与，但未完全排除内部作案的可能性，并称已排除该可能性。", "what_changed_en": "Bitget CEO Gracy Chen said she is 'not very optimistic' about freezing or recovering the funds from the ~$388M breach, citing Bybit's Feb 2025 hack (only ~3.5% of stolen funds frozen) as a reference. Bitget launched a bounty offering 5% for frozen and 5% for recovered funds. NEAR Intents team said it blocked over $50M in assets tied to the attack and froze ~$500K; Chen confirmed Tether and Circle blacklisted a linked wallet, freezing $318,013 in USDT/USDC. Withdrawals resumed in stages: BTC on Monday, ETH on Tuesday. Chen said North Korea may be responsible but did not fully rule out an inside job, though she said that possibility had been ruled out.", "current_state_zh": "Bitget 正分阶段恢复提现（周一BTC，周二ETH），并已启动赏金计划（冻结资金5%、追回资金5%）；NEAR Intents 拦截逾5000万美元相关资产并冻结约50万美元，Tether 与 Circle 已冻结约31.8万美元；CEO Gracy Chen 对追回约3.88亿美元损失“不太乐观”，并称已排除内部作案可能。", "current_state_en": "Bitget is resuming withdrawals in stages (BTC Monday, ETH Tuesday) and launched a bounty (5% for frozen, 5% for recovered funds); NEAR Intents blocked over $50M in related assets and froze ~$500K; Tether and Circle froze ~$318K; CEO Gracy Chen is 'not very optimistic' about recovering the ~$388M loss and said an inside job has been ruled out.", "detailed_summary_zh": "Bitget CEO Gracy Chen said she is 'not very optimistic' about freezing or recovering the funds lost in the exchange's $388 million security breach, citing Bybit's 2025 hack, where only about 3.5% of stolen assets were ever frozen, as a reference point.", "detailed_summary_en": "Bitget CEO Gracy Chen said she is 'not very optimistic' about freezing or recovering the funds lost in the exchange's $388 million security breach, citing Bybit's 2025 hack, where only about 3.5% of stolen assets were ever frozen, as a reference point.", "background_zh": "Bitget 最初将 2026 年 9 月 24 日（周四）的事件报告为约 3.52 亿美元损失并暂停提现，随后 Chen 在“更完整的转账核算”后将该数字更新为约 3.88 亿美元。2025 年 2 月 21 日的 Bybit 被盗事件中约有 15 亿美元的以太币被窃，据报道冻结与追回合计仅约 8000 万美元。此次事件是 2026 年加密行业规模最大的安全事件之一，此前 9 月 Liquid Network 曾遭遇 3.2 亿美元漏洞利用；与 2022 年 Ronin Bridge 的 6.15 亿美元和 2021 年 Poly Network 的 6.11 亿美元相比规模较小。", "background_en": "Bitget initially reported the Thursday, September 24, 2026 incident as a loss of about $352 million and suspended withdrawals, before Chen updated the figure to roughly $388 million after a \"more complete accounting of transfers.\" Bybit's February 21, 2025 hack saw roughly $1.5 billion in Ether stolen, with only about $80 million reportedly frozen and recovered combined. The breach is among the largest to hit crypto in 2026, following a $320 million exploit of the Liquid Network in September, and ranks below the $615 million Ronin Bridge hack in 2022 and the $611 million Poly Network hack in 2021.", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "这一表态对中心化交易所风险认知以及将资产存放于 Bitget 的用户影响最大：报道称冷钱包安全、提现分阶段恢复，限制了直接的流动性传染，但偏低的追回预期会削弱市场对交易所托管的信心。同时，这也凸显稳定币发行方的黑名单机制（Tether 与 Circle 冻结 318,013 美元）是对已追踪被盗资金一条具体但有限的追回渠道。", "market_impact_en": "The signal matters most for centralized-exchange risk perception and for users holding balances on Bitget, since the reported cold-wallet safety and phased withdrawal resumption limit direct liquidity contagion while the low expected recovery rate weighs on confidence in exchange custody. It also highlights stablecoin issuer blacklisting — Tether and Circle freezing $318,013 — as a concrete, if limited, recovery channel for traced exploit funds.", "importance_score": 8.5, "references": [ { "url": "https://www.trmlabs.com/resources/blog/the-bybit-hack-following-north-koreas-largest-exploit", "title": "The Bybit Hack: Following North Korea’s Largest Exploit | TRM Labs" }, { "url": "https://www.bitget.com/campaigns/bitget-security-incident-2026", "title": "Bitget Security Incident (September 2026): Hack Timeline ..." }, { "url": "https://blockonomi.com/stablecoin-issuers-freeze-318k-in-stolen-funds-following-bitget-exchange-breach", "title": "Stablecoin Issuers Freeze $318K in Stolen Funds Following Bitget Exchange Breach - Blockonomi" } ], "confidence": 0.93, "story_ids": [ "rss:cointelegraph.com_rss:63f77747b6fda2d2", "google_news:article:286934996020c0b4", "google_news:article:7580a3f2ce577edd" ], "sources": [ { "url": "https://cointelegraph.com/news/bitget-ceo-gracy-chen-chances-recovering-funds-security-breach?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound", "label": "Cointelegraph", "source_type": "rss", "official": false }, { "url": "https://finance.biggo.com/news/c47bc205-d1b8-43b7-addc-efd88c31d316", "label": "finance.biggo.com", "source_type": "google_news", "official": false }, { "url": "https://www.tradingview.com/news/cointelegraph:5b2742f6b094b:0-bitget-ceo-not-very-optimistic-on-recovering-funds-from-388m-breach/", "label": "TradingView", "source_type": "google_news", "official": false } ] }, { "update_id": "upd_4761a527d237ffe1", "event_id": "evt_6655595dc1e36e0b", "occurred_at": "2026-09-29T19:18:15Z", "published_at": "2026-09-29T19:18:15Z", "first_seen_at": "2026-09-29T23:52:14.237753Z", "time_precision": "published", "update_type": "escalation", "material_change": true, "title_zh": "Bitget 3.88亿美元黑客事件：CEO援引Bybit 3.5%冻结率", "title_en": "Bitget $388M Hack: CEO Cites Bybit's 3.5% Freeze Rate", "what_changed_zh": "Bitget CEO Gracy Chen就交易所3.88亿美元黑客事件后的追回工作作出回应，将其与Bybit 15亿美元被盗事件进行对比，并援引Bybit 3.5%的冻结率作为比较基准。", "what_changed_en": "Bitget CEO Gracy Chen addressed recovery efforts following a $388M hack at the exchange, contrasting them with Bybit's $1.5B breach and citing Bybit's 3.5% freeze rate as a comparative benchmark.", "current_state_zh": "Bitget CEO Gracy Chen就交易所3.88亿美元黑客事件后的追回工作作出回应，将其与Bybit 15亿美元被盗事件进行对比，并援引Bybit 3.5%的冻结率作为比较基准。", "current_state_en": "Bitget CEO Gracy Chen addressed recovery efforts following a $388M hack at the exchange, contrasting them with Bybit's $1.5B breach and citing Bybit's 3.5% freeze rate as a comparative benchmark.", "detailed_summary_zh": "Bitget CEO Gracy Chen addressed recovery efforts following a $388M hack at the exchange, contrasting them with Bybit's $1.5B breach and citing Bybit's 3.5% freeze rate as a comparative benchmark.", "detailed_summary_en": "Bitget CEO Gracy Chen addressed recovery efforts following a $388M hack at the exchange, contrasting them with Bybit's $1.5B breach and citing Bybit's 3.5% freeze rate as a comparative benchmark.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 9.0, "references": [], "confidence": 0.75, "story_ids": [ "google_news:article:12c29691e476e261" ], "sources": [ { "url": "https://financefeeds.com/gracy-chen-compares-bitget-hack-recovery-efforts-with-bybits-1-5b-breach/", "label": "FinanceFeeds", "source_type": "google_news", "official": false } ] }, { "update_id": "upd_9de0dd9c2064ae59", "event_id": "evt_6655595dc1e36e0b", "occurred_at": "2026-09-30T03:01:20Z", "published_at": "2026-09-30T03:01:20Z", "first_seen_at": "2026-09-30T10:38:05.143967Z", "time_precision": "published", "update_type": "aftermath", "material_change": true, "title_zh": "【慢雾余弦：朝鲜黑客利用 Cow 与 Chainflip 跨链转移 Bitget 被盗资金并兑换为 BTC】", "title_en": "【慢雾余弦：朝鲜黑客利用 Cow 与 Chainflip 跨链转移 Bitget 被盗资金并兑换为 BTC】", "what_changed_zh": "慢雾余弦报告朝鲜黑客利用 Cow Protocol 和 Chainflip 跨链转移 Bitget 被盗资金并兑换为 BTC。", "what_changed_en": "SlowMist's Yu Xian reports North Korean hackers are laundering Bitget's stolen funds by using Cow Protocol and Chainflip for cross-chain swaps into BTC.", "current_state_zh": "Bitget 被盗资金正被朝鲜黑客通过 Cow Protocol 和 Chainflip 跨链兑换为 BTC，进行洗钱活动。", "current_state_en": "Bitget's stolen funds are being laundered by North Korean hackers via Cow Protocol and Chainflip cross-chain swaps into BTC.", "detailed_summary_zh": "SlowMist founder Yu Xian reports that North Korean hackers are laundering Bitget's stolen funds by automating Cow Protocol orders routed to pre-staged Chainflip deposit addresses to cross-chain swap the assets into Bitcoin.", "detailed_summary_en": "SlowMist founder Yu Xian reports that North Korean hackers are laundering Bitget's stolen funds by automating Cow Protocol orders routed to pre-staged Chainflip deposit addresses to cross-chain swap the assets into Bitcoin.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 7.0, "references": [], "confidence": 0.9, "story_ids": [ "telegram:foresightnews:119455" ], "sources": [ { "url": "https://foresightnews.pro/news/h5Detail/114294", "label": "foresightnews", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_27eeee702e01c6c8", "event_id": "evt_6655595dc1e36e0b", "occurred_at": "2026-09-30T03:14:53Z", "published_at": "2026-09-30T03:14:53Z", "first_seen_at": "2026-09-30T10:38:03.178269Z", "time_precision": "published", "update_type": "escalation", "material_change": true, "title_zh": "SlowMist：疑似朝鲜黑客通过CoW、Chainfl转移Bitget资金", "title_en": "SlowMist: Suspected North Korean Hackers Route Bitget Funds Through CoW, Chainfl", "what_changed_zh": "SlowMist的MistTrack报告称，疑似朝鲜黑客正利用自动化的CoW Protocol订单洗白从Bitget窃取的资金（约3.5亿美元黑客事件），这些订单将结算资产转入预先生成的Chainflip存款合约，以转换为BTC。", "what_changed_en": "SlowMist's MistTrack reports suspected North Korean hackers are laundering stolen Bitget funds (~$350M hack) by using automated CoW Protocol orders that route settled assets into pre-generated Chainflip deposit contracts for conversion to BTC.", "current_state_zh": "SlowMist的MistTrack报告称，疑似朝鲜黑客正利用自动化的CoW Protocol订单洗白从Bitget窃取的资金（约3.5亿美元黑客事件），这些订单将结算资产转入预先生成的Chainflip存款合约，以转换为BTC。", "current_state_en": "SlowMist's MistTrack reports suspected North Korean hackers are laundering stolen Bitget funds (~$350M hack) by using automated CoW Protocol orders that route settled assets into pre-generated Chainflip deposit contracts for conversion to BTC.", "detailed_summary_zh": "SlowMist's MistTrack reports suspected North Korean hackers are laundering stolen Bitget funds (~$350M hack) by using automated CoW Protocol orders that route settled assets into pre-generated Chainflip deposit contracts for conversion to BTC.", "detailed_summary_en": "SlowMist's MistTrack reports suspected North Korean hackers are laundering stolen Bitget funds (~$350M hack) by using automated CoW Protocol orders that route settled assets into pre-generated Chainflip deposit contracts for conversion to BTC.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.5, "references": [], "confidence": 0.75, "story_ids": [ "telegram:wublockchainenglish:26221" ], "sources": [ { "url": "https://wublockchain.xyz/news/slowmist-suspected-nk-hackers-route-bitget-funds-through-cow-chainflip-21048", "label": "wublockchainenglish", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_f184b5049cebd455", "event_id": "evt_6655595dc1e36e0b", "occurred_at": "2026-09-30T04:08:42Z", "published_at": "2026-09-30T04:08:42Z", "first_seen_at": "2026-09-30T10:38:05.146716Z", "time_precision": "published", "update_type": "confirmation", "material_change": true, "title_zh": "【慢雾：Bitget 热钱包被盗事件涉及第三方产品零日漏洞】", "title_en": "【慢雾：Bitget 热钱包被盗事件涉及第三方产品零日漏洞】", "what_changed_zh": "慢雾初步调查发现，9月25日 Bitget 热钱包被盗源于第三方产品零日漏洞，攻击者利用受影响的内部员工身份及定制提现工具，链上跨链转账持续约2小时52分钟，并后续试图操纵提现记录以触发额外 BTC 提现；慢雾仍在调查攻击者在受影响系统间的移动路径。", "what_changed_en": "SlowMist's preliminary investigation found that the September 25 Bitget hot wallet theft stemmed from a third-party product zero-day exploited with a compromised internal employee identity and a customized withdrawal tool, enabling ~2h52m of cross-chain transfers and further attempts to manipulate withdrawal records to trigger additional BTC withdrawals; SlowMist is still investigating how the attacker moved between affected systems.", "current_state_zh": "SlowMist 初步调查将 9月25日 Bitget 热钱包被盗归因于第三方产品零日漏洞与内部员工身份被利用，攻击者使用定制提现工具并在约2小时52分钟内跨多条链转移资产，还试图触发额外 BTC 提现；慢雾仍在继续调查。此前已分阶段恢复提现、推出赏金计划，NEAR Intents 拦截逾5000万美元相关资产并冻结约50万美元，Tether 与 Circle 冻结约31.8万美元；CEO 对追回约3.88亿美元损失不乐观，且此前称已排除内部作案可能，但初步调查所称内部员工身份被利用与此前说法存在张力。", "current_state_en": "SlowMist's preliminary investigation attributes the September 25 Bitget hot wallet theft to a third-party product zero-day and a compromised internal employee identity, with the attacker using a customized withdrawal tool to move assets across multiple chains over ~2h52m and attempting further BTC withdrawals; SlowMist continues investigating. Previously, Bitget was resuming withdrawals in stages, launched a bounty, NEAR Intents blocked over $50M in related assets and froze ~$500K, Tether and Circle froze ~$318K, and CEO Gracy Chen was 'not very optimistic' about recovering the ~$388M loss while saying an inside job had been ruled out — a statement now in tension with the preliminary finding of a compromised internal employee identity.", "detailed_summary_zh": "SlowMist's preliminary investigation found that the September 25 Bitget hot wallet theft stemmed from a third-party product zero-day exploited with a compromised internal employee identity and a customized withdrawal tool, enabling ~2h52m of cross-chain transfers and further fraudulent BTC withdrawal attempts.", "detailed_summary_en": "SlowMist's preliminary investigation found that the September 25 Bitget hot wallet theft stemmed from a third-party product zero-day exploited with a compromised internal employee identity and a customized withdrawal tool, enabling ~2h52m of cross-chain transfers and further fraudulent BTC withdrawal attempts.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.5, "references": [], "confidence": 0.96, "story_ids": [ "telegram:foresightnews:119467" ], "sources": [ { "url": "https://foresightnews.pro/news/h5Detail/114304", "label": "foresightnews", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_442ea8a8d108ba85", "event_id": "evt_6655595dc1e36e0b", "occurred_at": "2026-09-30T07:34:33Z", "published_at": "2026-09-30T07:34:33Z", "first_seen_at": "2026-09-30T10:38:05.152260Z", "time_precision": "published", "update_type": "remediation", "material_change": true, "title_zh": "【Bitget 已向保护基金划转 2000 枚 BTC，规模回升至 2 亿美元】", "title_en": "【Bitget 已向保护基金划转 2000 枚 BTC，规模回升至 2 亿美元】", "what_changed_zh": "Bitget 从冷钱包划转 2,000 枚 BTC（约 1.66 亿美元）至保护基金地址，使保护基金链上余额回升至 2,484.71 枚 BTC（约 2.06 亿美元），开始兑现一周内补足 3 亿美元的承诺。", "what_changed_en": "Bitget moved 2,000 BTC (~$166M) from its cold wallet to its protection fund address, restoring the fund's on-chain balance to 2,484.71 BTC (~$206M), beginning to fulfill its pledge to replenish the fund to $300M within a week.", "current_state_zh": "SlowMist 初步调查将 9月25日 Bitget 热钱包被盗归因于第三方产品零日漏洞与内部员工身份被利用，攻击者使用定制提现工具并在约 2 小时 52 分钟内跨多条链转移资产，还试图触发额外 BTC 提现；SlowMist 仍在继续调查。此前已分阶段恢复提现、推出赏金计划，NEAR Intents 拦截逾 5000 万美元相关资产并冻结约 50 万美元，Tether 与 Circle 冻结约 31.8 万美元；CEO 对追回约 3.88 亿美元损失不乐观。最新进展：Bitget 已从冷钱包划转 2,000 枚 BTC（约 1.66 亿美元）至保护基金，基金链上余额回升至 2,484.71 枚 BTC（约 2.06 亿美元），兑现一周内补足 3 亿美元承诺。", "current_state_en": "SlowMist's preliminary investigation attributes the September 25 Bitget hot wallet theft to a third-party product zero-day and a compromised internal employee identity, with the attacker using a customized withdrawal tool to move assets across multiple chains over ~2h52m and attempting further BTC withdrawals; SlowMist continues investigating. Previously, Bitget resumed withdrawals in stages, launched a bounty, NEAR Intents blocked over $50M in related assets and froze ~$500K, Tether and Circle froze ~$318K, and CEO Gracy Chen was 'not very optimistic' about recovering the ~$388M loss. Latest development: Bitget has moved 2,000 BTC (~$166M) from its cold wallet to its protection fund, bringing the fund's on-chain balance back to 2,484.71 BTC (~$206M), fulfilling part of its pledge to restore the fund to $300M within a week.", "detailed_summary_zh": "Bitget moved 2,000 BTC (~$166M) from its cold wallet into its protection fund, bringing the fund's on-chain balance back to 2,484.71 BTC (~$206M) as the exchange begins making good on its pledge to restore the fund to $300M within a week.", "detailed_summary_en": "Bitget moved 2,000 BTC (~$166M) from its cold wallet into its protection fund, bringing the fund's on-chain balance back to 2,484.71 BTC (~$206M) as the exchange begins making good on its pledge to restore the fund to $300M within a week.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 7.0, "references": [], "confidence": 0.92, "story_ids": [ "telegram:foresightnews:119492" ], "sources": [ { "url": "https://foresightnews.pro/news/h5Detail/114327", "label": "foresightnews", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_1fd705bb7cd28e87", "event_id": "evt_6655595dc1e36e0b", "occurred_at": "2026-09-30T10:05:39Z", "published_at": "2026-09-30T10:05:39Z", "first_seen_at": "2026-09-30T10:38:20.358795Z", "time_precision": "published", "update_type": "confirmation", "material_change": true, "title_zh": "SlowMist将Bitget黑客活动追溯至8月31日的零日漏洞利用", "title_en": "SlowMist traces Bitget hack activity to Aug. 31 zero-day exploit", "what_changed_zh": "SlowMist 进度报告将 Bitget 被盗事件最早的恶意活动追溯至 8月31日——攻击者利用第三方安全产品零日漏洞；调查还发现攻击者通过隐藏脚本从环境变量获取密码后访问“产品 A”数据库，并在 9月23日与 9月25日于另外两个节点发现类似活动，9月25日又以内部员工身份访问第二款安全产品“产品 B”的管理平台，尝试注入系统命令、篡改服务器配置并上传恶意文件；链上验证显示最早转让发生于 9月25日 UTC+8 凌晨 2:31（93 TRX，11 秒后 0.84 ETH），持续约 2 小时 52 分钟至 5:23。", "what_changed_en": "SlowMist's progress report traces the earliest malicious activity in the Bitget theft to Aug. 31, when an attacker exploited a zero-day in a third-party security product; it also found the attacker accessed 'Product A' database via a hidden script after retrieving its password from an environment variable, with similar activity on two other nodes on Sept. 23 and Sept. 25, and on Sept. 25 accessed a second security product ('Product B') management platform using an internal employee identity, attempting command injection, server config changes and uploading malicious files; on-chain verification found the earliest transfer at 2:31 am UTC+8 Sept. 25 (93 TRX, then 0.84 ETH 11 seconds later), compiled transfers spanning ~2h52m until 5:23 am.", "current_state_zh": "SlowMist 调查将 9月25日 Bitget 热钱包被盗（约 3.88 亿美元）的时间线前推至 8月31日，认定攻击者利用第三方安全产品零日漏洞，经数周潜伏横向移动于两款第三方安全产品及一个钱包应用主机之间，并使用高度定制的删除后提现工具伪造风控参数发起提现；慢雾仍在调查攻击者在受影响系统间的移动路径。Bitget 此前已分阶段恢复提现、推出赏金计划，NEAR Intents 拦截逾 5000 万美元相关资产并冻结约 50 万美元，Tether 与 Circle 冻结约 31.8 万美元；Bitget 已从冷钱包划转 2,000 枚 BTC 至保护基金，基金余额回升至 2,484.71 枚 BTC（约 2.06 亿美元）。", "current_state_en": "SlowMist's investigation pushes the timeline of the Sept. 25 Bitget hot wallet theft (~$388M) back to Aug. 31, attributing it to a third-party security product zero-day; the attacker moved laterally over weeks across two third-party security products and a wallet application host, and used a deleted, highly customized withdrawal tool that forged risk-control parameters to issue withdrawal requests; SlowMist continues investigating how the attacker moved between affected systems. Bitget had previously resumed withdrawals in stages, launched a bounty, NEAR Intents blocked over $50M in related assets and froze ~$500K, Tether and Circle froze ~$318K, and Bitget moved 2,000 BTC from its cold wallet to its protection fund, restoring the fund to 2,484.71 BTC (~$206M).", "detailed_summary_zh": "SlowMist's investigation traced the earliest malicious activity in Bitget's $388 million hack to an Aug. 31 zero-day exploit in a third-party security product, revealing a weeks-long attack campaign.", "detailed_summary_en": "SlowMist's investigation traced the earliest malicious activity in Bitget's $388 million hack to an Aug. 31 zero-day exploit in a third-party security product, revealing a weeks-long attack campaign.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 7.5, "references": [], "confidence": 0.92, "story_ids": [ "rss:cointelegraph.com_rss:1c5a2dda24a0312a" ], "sources": [ { "url": "https://cointelegraph.com/news/bitget-hack-zero-day-slowmist-investigation?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound", "label": "Cointelegraph", "source_type": "rss", "official": false } ] }, { "update_id": "upd_08764820fd803ac2", "event_id": "evt_6655595dc1e36e0b", "occurred_at": "2026-09-30T10:23:24Z", "published_at": "2026-09-30T10:23:24Z", "first_seen_at": "2026-09-30T10:38:05.155975Z", "time_precision": "published", "update_type": "aftermath", "material_change": true, "title_zh": "【Bitget 被盗事件攻击者开始将约 2700 枚 ZEC 转入 Ironwood 屏蔽池】", "title_en": "【Bitget 被盗事件攻击者开始将约 2700 枚 ZEC 转入 Ironwood 屏蔽池】", "what_changed_zh": "链上侦探 ZachXBT 表示，与 Bitget 热钱包被盗事件相关的攻击者已开始将约 2,700 枚 ZEC（约 380 万美元）转入 Zcash 的 Ironwood 屏蔽池；Bitget 热钱包此前共被盗约 1.89 万枚 ZEC（约 2,830 万美元）。", "what_changed_en": "On-chain investigator ZachXBT said the attacker linked to the Bitget hot-wallet theft has started moving roughly 2,700 ZEC (~$3.8M) into Zcash's Ironwood shielded pool; the Bitget hot wallet had lost about 18,900 ZEC (~$28.3M) in total.", "current_state_zh": "慢雾调查将 Bitget 热钱包被盗时间线前推至 8月31日，认定攻击者利用第三方安全产品零日漏洞，经数周潜伏横向移动并使用定制提现工具伪造风控参数发起提现；Bitget 已分阶段恢复提现、推出赏金计划，NEAR Intents 拦截逾 5000 万美元相关资产并冻结约 50 万美元，Tether 与 Circle 冻结约 31.8 万美元，Bitget 已从冷钱包划转 2,000 枚 BTC 至保护基金。最新进展：疑似朝鲜关联的攻击者开始将约 2,700 枚 ZEC（约 380 万美元）转入 Zcash 的 Ironwood 屏蔽池，该批 ZEC 来自此前被盗的约 1.89 万枚 ZEC（约 2,830 万美元）。", "current_state_en": "SlowMist pushed the Bitget hot-wallet theft timeline back to Aug. 31, attributing it to a third-party security product zero-day; the attacker moved laterally over weeks and used a customized withdrawal tool that forged risk-control parameters. Bitget resumed withdrawals in stages, launched a bounty, NEAR Intents blocked over $50M in related assets and froze ~$500K, Tether and Circle froze ~$318K, and Bitget moved 2,000 BTC from its cold wallet to its protection fund. Latest development: the suspected DPRK-linked attacker began moving roughly 2,700 ZEC (~$3.8M) into Zcash's Ironwood shielded pool, part of the ~18,900 ZEC (~$28.3M) stolen from Bitget's hot wallet.", "detailed_summary_zh": "An attacker linked to the Bitget hot-wallet theft has started moving roughly 2,700 ZEC (~$3.8 million) of the ~$28.3 million stolen into Zcash's Ironwood shielded pool, according to on-chain investigator ZachXBT.", "detailed_summary_en": "An attacker linked to the Bitget hot-wallet theft has started moving roughly 2,700 ZEC (~$3.8 million) of the ~$28.3 million stolen into Zcash's Ironwood shielded pool, according to on-chain investigator ZachXBT.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 7.0, "references": [], "confidence": 0.96, "story_ids": [ "telegram:foresightnews:119508", "telegram:wublockchainenglish:26226" ], "sources": [ { "url": "https://foresightnews.pro/news/h5Detail/114339", "label": "foresightnews", "source_type": "telegram", "official": false }, { "url": "https://wublockchain.xyz/news/news-21053", "label": "wublockchainenglish", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_365d7d2b2150dc90", "event_id": "evt_6655595dc1e36e0b", "occurred_at": "2026-09-30T16:28:30Z", "published_at": "2026-09-30T16:28:30Z", "first_seen_at": "2026-09-30T18:04:19.070907Z", "time_precision": "published", "update_type": "remediation", "material_change": true, "title_zh": "Bitget「逐步恢复正常」，保护基金规模达3.09亿美元", "title_en": "Bitget ‘gradually back to usual’ as protection fund reaches $309M", "what_changed_zh": "Bitget CEO Gracy Chen 表示运营正逐步恢复正常，保护基金规模已达到 3.09 亿美元；所有代币提现将于周五恢复，BTC、ETH 和 USDT 提现已先恢复。她同时称该事件造成 3.88 亿美元用户损失，Bitget 仍未排除内部人员或朝鲜黑客等责任方。", "what_changed_en": "Bitget CEO Gracy Chen said operations are gradually returning to normal and the Protection Fund has reached $309M; withdrawals for all tokens will resume Friday, while BTC, ETH and USDT access has already been restored. She said the incident resulted in $388M in user losses and Bitget has still not ruled out an inside job or North Korean hackers.", "current_state_zh": "Bitget 正逐步恢复正常运营，保护基金规模达到 3.09 亿美元；BTC、ETH 和 USDT 提现已恢复，所有代币提现预计周五恢复。CEO 称事件造成 3.88 亿美元用户损失，仍未排除内部人员或朝鲜黑客等责任方；此前已报告的攻击者将 ZEC 转入 Ironwood 屏蔽池等调查仍在继续。", "current_state_en": "Bitget is gradually returning to normal operations, with its Protection Fund reaching $309M; BTC, ETH and USDT withdrawals are restored, and withdrawals for all tokens are expected to resume Friday. The CEO said the incident caused $388M in user losses and that an inside job or North Korean hackers have not been ruled out; prior investigation items such as the attacker moving ZEC into the Ironwood shielded pool continue.", "detailed_summary_zh": "Bitget's CEO said operations are gradually returning to normal after a security breach cost users $388 million, with withdrawals for all tokens resuming Friday, BTC/ETH/USDT access already restored, and the exchange's Protection Fund standing at $309 million.", "detailed_summary_en": "Bitget's CEO said operations are gradually returning to normal after a security breach cost users $388 million, with withdrawals for all tokens resuming Friday, BTC/ETH/USDT access already restored, and the exchange's Protection Fund standing at $309 million.", "background_zh": "此次事件属于加密货币交易所安全漏洞事件的一部分，Bitget的保护基金被宣传为其储备证明（Proof of Reserves）之外的另一层抗风险保障。周三，链上调查人员ZachXBT报告称，与Bitget黑客事件相关的钱包将约380万美元的Zcash（ZEC）转入该网络的Ironwood池，约占此次被盗18,917枚ZEC的14%。NEAR Intents另行表示，其已拦截与Bitget黑客相关的5,000万美元资金。", "background_en": "The incident sits within a broader pattern of crypto exchange security breaches, and Bitget's Protection Fund is marketed as an additional layer of resilience alongside its Proof of Reserves. On Wednesday, blockchain investigator ZachXBT reported that wallets tied to the Bitget hack moved about $3.8 million in Zcash (ZEC) into the network's Ironwood pool — roughly 14% of the 18,917 ZEC stolen in the attack. NEAR Intents separately said it blocked $50 million tied to the Bitget hackers.", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "该事件的传导渠道主要是交易所偿付能力与托管信心：Bitget自身代币及其BTC/ETH/USDT提现通道是直接受影响的板块，而攻击者据报将被盗ZEC转入隐私池的举动，也令隐私资产洗钱渠道受到关注。此类规模的交易所安全事件还可能影响用户对中心化平台托管的信心，以及与交易平台相关的稳定币资金流动。", "market_impact_en": "The event transmits to markets mainly through exchange-solvency and custody sentiment: Bitget's own token and its BTC/ETH/USDT withdrawal rails are the directly exposed segments, while the attackers' reported movement of stolen ZEC into a privacy pool draws attention to privacy-asset laundering channels. Broader exchange-security incidents of this size can also weigh on user confidence in centralized venue custody and on stablecoin flows tied to trading venues.", "importance_score": 8.5, "references": [ { "url": "https://www.bitget.com/promotion/protection-fund", "title": "5500 BTC Protection Fund | Bitget" }, { "url": "https://www.itbitget.com/academy/bitget-protection-fund-to-protect-user-assets", "title": "Bitget Protection Fund to Protect User's Assets" } ], "confidence": 0.92, "story_ids": [ "rss:cointelegraph.com_rss:4a572133f998250e", "rss:cryptoslate.com_feed_:a8b0cf5a9ed0cd88" ], "sources": [ { "url": "https://cointelegraph.com/news/bitget-operations-protection-fund-security-breach?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound", "label": "Cointelegraph", "source_type": "rss", "official": false }, { "url": "https://cryptoslate.com/bitget-restores-300m-fund-after-absorbing-388m-security-breach/", "label": "CryptoSlate", "source_type": "rss", "official": false } ] }, { "update_id": "upd_df05f30f53c051c0", "event_id": "evt_6655595dc1e36e0b", "occurred_at": "2026-09-30T18:49:57Z", "published_at": "2026-09-30T18:49:57Z", "first_seen_at": "2026-10-01T00:03:15.781722Z", "time_precision": "published", "update_type": "escalation", "material_change": true, "title_zh": "Bitget CEO 认为追回 3.88 亿美元被盗资金的可能性渺茫", "title_en": "Bitget CEO Sees Slim Odds of Recovering $388M Breach Funds", "what_changed_zh": "Bitget CEO 表示，追回该交易所被盗的约 3.88 亿美元的机会很小，这暗示这些资金很可能无法追回。", "what_changed_en": "Bitget's CEO said there is little chance of recovering the roughly $388 million lost in the exchange's breach, signaling the funds are likely unrecoverable.", "current_state_zh": "Bitget CEO 表示，追回该交易所被盗的约 3.88 亿美元的机会很小，这暗示这些资金很可能无法追回。", "current_state_en": "Bitget's CEO said there is little chance of recovering the roughly $388 million lost in the exchange's breach, signaling the funds are likely unrecoverable.", "detailed_summary_zh": "Bitget's CEO said there is little chance of recovering the roughly $388 million lost in the exchange's breach, signaling the funds are likely unrecoverable.", "detailed_summary_en": "Bitget's CEO said there is little chance of recovering the roughly $388 million lost in the exchange's breach, signaling the funds are likely unrecoverable.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.5, "references": [], "confidence": 0.75, "story_ids": [ "google_news:article:c898923a2afda6dc", "google_news:article:60e1a2a9881c2ef2", "google_news:article:2c4a4f9e07eb24c6" ], "sources": [ { "url": "https://www.altcoinbuzz.io/bitget-ceo-sees-slim-odds-of-recovering-388m-breach-funds", "label": "Altcoin Buzz", "source_type": "google_news", "official": false }, { "url": "https://startupfortune.com/bitgets-ceo-tells-cnbc-most-of-its-stolen-388-million-is-probably-gone/", "label": "Startup Fortune", "source_type": "google_news", "official": false }, { "url": "https://www.cnbc.com/2026/10/02/bitget-crypto-stolen-hack-recovery.html", "label": "CNBC", "source_type": "google_news", "official": false } ] }, { "update_id": "upd_55eb5469efba4788", "event_id": "evt_6655595dc1e36e0b", "occurred_at": "2026-10-01T07:00:00Z", "published_at": "2026-10-01T07:00:00Z", "first_seen_at": "2026-10-01T10:31:10.990106Z", "time_precision": "published", "update_type": "confirmation", "material_change": true, "title_zh": "Bitget 遭朝鲜黑客攻击损失 3.88 亿美元；Coinbase 也被黑了吗？", "title_en": "Bitget loses $388M after DPRK hack; was Coinbase hacked too?", "what_changed_zh": "据报道，Bitget 在一次与朝鲜行为者有关的黑客攻击中损失了 3.88 亿美元，同一报道还质疑 Coinbase 是否也遭到了入侵。", "what_changed_en": "Bitget reportedly lost $388 million in a hack linked to North Korean actors, with the same report questioning whether Coinbase was also breached.", "current_state_zh": "据报道，Bitget 在一次与朝鲜行为者有关的黑客攻击中损失了 3.88 亿美元，同一报道还质疑 Coinbase 是否也遭到了入侵。", "current_state_en": "Bitget reportedly lost $388 million in a hack linked to North Korean actors, with the same report questioning whether Coinbase was also breached.", "detailed_summary_zh": "Bitget reportedly lost $388 million in a hack linked to North Korean actors, with the same report questioning whether Coinbase was also breached.", "detailed_summary_en": "Bitget reportedly lost $388 million in a hack linked to North Korean actors, with the same report questioning whether Coinbase was also breached.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 9.0, "references": [], "confidence": 0.75, "story_ids": [ "google_news:article:c6c19be5ed31d92a" ], "sources": [ { "url": "https://coingeek.com/bitget-loses-388m-after-dprk-hack-was-coinbase-hacked-too/", "label": "CoinGeek", "source_type": "google_news", "official": false } ] }, { "update_id": "upd_dc35133d628ea7a7", "event_id": "evt_6655595dc1e36e0b", "occurred_at": "2026-10-01T13:35:47Z", "published_at": "2026-10-01T13:35:47Z", "first_seen_at": "2026-10-01T15:11:20.438454Z", "time_precision": "published", "update_type": "aftermath", "material_change": true, "title_zh": "Bitget 3.88 亿美元黑客攻击使第三季度加密安全损失超过 10 亿美元", "title_en": "Bitget’s $388M hack pushes Q3 crypto security losses past $1B", "what_changed_zh": "CertiK 数据显示 2026 年 Q3 加密安全损失达 12.6 亿美元，其中 Bitget 被盗 3.875 亿美元（约占 31%）；新报道还补充了攻击细节：Bitget 于 9 月 24 日发现热钱包未经授权转账并暂停提款，攻击者利用第三方安全产品漏洞获取内部凭证并伪造提款指令，SlowMist 将活动追溯至 8 月 31 日零日漏洞。", "what_changed_en": "CertiK data shows Q3 2026 crypto security losses hit $1.26 billion, with Bitget’s $387.5 million hack accounting for about 31%; the report adds attack details: Bitget detected unauthorized hot-wallet transfers on Sept. 24 and suspended withdrawals, attackers exploited a third-party security product vulnerability to obtain internal credentials and forge withdrawal commands, and SlowMist traced activity to an Aug. 31 zero-day exploit.", "current_state_zh": "Bitget 在一次与朝鲜行为者有关的黑客攻击中损失约 3.88 亿美元，CEO 称资金追回希望渺茫；新报道确认该事件为 Q3 2026 最大加密安全事件，约占当季 12.6 亿美元损失的 31%，并补充攻击者通过第三方安全产品漏洞获取凭证、伪造提款指令，活动可追溯至 8 月 31 日零日漏洞。", "current_state_en": "Bitget reportedly lost about $388 million in a hack linked to North Korean actors, with its CEO seeing slim odds of recovery; the new report confirms it as Q3 2026’s largest crypto security incident, about 31% of the quarter’s $1.26 billion in losses, and adds that attackers exploited a third-party security product vulnerability to obtain credentials and forge withdrawal commands, with activity traced to an Aug. 31 zero-day exploit.", "detailed_summary_zh": "CertiK data shows crypto security losses hit $1.26 billion in Q3 2026 across 247 incidents, driven by the $387.5 million Bitget exchange hack, with September alone accounting for roughly $769 million in losses.", "detailed_summary_en": "CertiK data shows crypto security losses hit $1.26 billion in Q3 2026 across 247 incidents, driven by the $387.5 million Bitget exchange hack, with September alone accounting for roughly $769 million in losses.", "background_zh": "CertiK 是一家追踪和审计 Web3 协议的区块链安全公司。该季度第二大事件是 9 月 6 日 Liquid Network 遭到的 3.19 亿美元漏洞利用，Liquid Network 是由 Blockstream 开发的联邦式比特币侧链。其后依次是 Tectonic 的 1.2 亿美元事件和 Coldcard 的 1.127 亿美元盗窃案。SlowMist 将 Bitget 黑客活动追溯至 8 月 31 日的零日漏洞利用，时间早于该季度报告的发布。", "background_en": "CertiK is a blockchain security firm that tracks and audits Web3 protocols. The quarter's second-largest incident was a $319 million exploit on the Liquid Network, a federated Bitcoin sidechain built by Blockstream, on Sept. 6. Tectonic followed at $120 million, and the Coldcard theft at $112.7 million. SlowMist traced Bitget hack activity to an Aug. 31 zero-day exploit, predating the publication of the quarterly report.", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "本季度损失集中在中心化交易所热钱包托管、比特币侧链代币背书和链上借贷三个环节：Bitget 于 9 月 24 日暂停提现、Liquid Network 涉及无背书 L-BTC 的漏洞利用、以及 Cronos 上 Tectonic 借贷协议被攻击，均属这些领域。这一量级的季度损失汇总数据会影响交易所、跨链桥和 DeFi 协议对托管安排、第三方供应商风险及储备的评估。", "market_impact_en": "The quarter's losses cluster in centralized exchange hot-wallet custody, Bitcoin-sidechain token backing and on-chain lending: Bitget's Sept. 24 withdrawal suspension, the Liquid Network exploit involving unbacked L-BTC, and the Tectonic lending exploit on Cronos all fell into those segments. Aggregate loss figures at this scale feed into how exchanges, bridges and DeFi protocols assess custody, third-party vendor risk and reserves.", "importance_score": 8.0, "references": [ { "url": "https://www.certik.com/", "title": "Largest Blockchain Security Auditor - CertiK" }, { "url": "https://www.cryptotimes.io/2026/09/30/bitget-liquid-hacks-drive-crypto-losses-to-766m-in-september-2026s-worst-month-certik/", "title": "Bitget, Liquid Hacks Drive Crypto Losses to $766M in September..." }, { "url": "https://www.cryptotimes.io/2026/09/08/cronos-rewound-10961-blocks-to-reverse-tectonic-hack-9-19m-still-missing/", "title": "Cronos Rewound 10,961 Blocks to Reverse Tectonic Hack..." }, { "url": "https://en.wikipedia.org/wiki/Zero-day_exploit", "title": "Zero-day exploit" }, { "url": "https://en.wikipedia.org/wiki/Bitget", "title": "Bitget - Wikipedia" } ], "confidence": 0.95, "story_ids": [ "rss:cointelegraph.com_rss:b6bc80bbfc883f25", "google_news:article:2a04601d04f86979" ], "sources": [ { "url": "https://cointelegraph.com/news/bitget-hack-q3-industry-losses-1-26-billion?utm_source=rss_feed&utm_medium=rss&utm_campaign=rss_partner_inbound", "label": "Cointelegraph", "source_type": "rss", "official": false }, { "url": "https://shattered.io/bitget-hack-388-million-zero-day-2026/", "label": "shattered.io", "source_type": "google_news", "official": false } ] }, { "update_id": "upd_b0bebdcd8b9e67a2", "event_id": "evt_6655595dc1e36e0b", "occurred_at": "2026-10-02T13:51:56Z", "published_at": "2026-10-02T13:51:56Z", "first_seen_at": "2026-10-02T14:41:06.184506Z", "time_precision": "published", "update_type": "confirmation", "material_change": true, "title_zh": "Chainalysis将Bitget 3.87亿美元黑客事件归咎于朝鲜行为者，并追踪资金流向F", "title_en": "Chainalysis Attributes Bitget’s $387M Hack to DPRK Actors, Traces Funds Across F", "what_changed_zh": "Chainalysis 将 Bitget 3.87 亿美元被盗事件归因于与朝鲜（DPRK）有关联的行为者，并追踪到资金在数小时内经 Ethereum、XRP、Zcash 和 Tron 四条链通过 23 笔转账转移（ETH 占 49.7%、XRP 占 40.8%），还追踪数千万美元被盗 XRP 经跨链流动性协议转为比特币，使 2026 年与朝鲜相关的加密盗窃总额超过 10 亿美元。", "what_changed_en": "Chainalysis attributed the $387M Bitget theft to DPRK-linked actors, tracing funds across Ethereum, XRP, Zcash and Tron through 23 transfers within hours (ETH 49.7%, XRP 40.8%), following tens of millions in stolen XRP into Bitcoin via cross-chain liquidity protocols, pushing total DPRK-linked crypto theft in 2026 above $1 billion.", "current_state_zh": "Bitget 被盗事件已被 Chainalysis 正式归因于朝鲜（DPRK）关联行为者；被盗的 3.87 亿美元资金在数小时内跨 Ethereum、XRP、Zcash、Tron 四链转移，部分 XRP 已跨链兑换为比特币，2026 年朝鲜相关加密盗窃总额突破 10 亿美元。Bitget 此前已恢复 BTC、ETH、USDT 提现，保护基金达 3.09 亿美元，并继续逐步恢复正常运营。", "current_state_en": "The Bitget theft has now been formally attributed by Chainalysis to DPRK-linked actors; the $387M in stolen funds moved across Ethereum, XRP, Zcash and Tron within hours, with some XRP swapped into Bitcoin, pushing total DPRK-linked crypto theft in 2026 above $1 billion. Bitget had already restored BTC, ETH and USDT withdrawals with a $309M Protection Fund and continues gradually returning to normal operations.", "detailed_summary_zh": "Chainalysis attributed Bitget's $387 million theft to DPRK-linked actors, tracing the funds across Ethereum, XRP, Zcash and Tron within hours of the hack and following tens of millions in XRP into Bitcoin, bringing total DPRK-linked crypto theft in 2026 above $1 billion.", "detailed_summary_en": "Chainalysis attributed Bitget's $387 million theft to DPRK-linked actors, tracing the funds across Ethereum, XRP, Zcash and Tron within hours of the hack and following tens of millions in XRP into Bitcoin, bringing total DPRK-linked crypto theft in 2026 above $1 billion.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 9.0, "references": [], "confidence": 0.9, "story_ids": [ "telegram:wublockchainenglish:26265" ], "sources": [ { "url": "https://wublockchain.xyz/news/chainalysis-links-bitget-387m-hack-to-dprk-actors-traces-funds-21093", "label": "wublockchainenglish", "source_type": "telegram", "official": false } ] }, { "update_id": "upd_045ea8d5ee615178", "event_id": "evt_6655595dc1e36e0b", "occurred_at": "2026-10-02T15:20:48Z", "published_at": "2026-10-02T15:20:48Z", "first_seen_at": "2026-10-02T17:57:54.736834Z", "time_precision": "published", "update_type": "escalation", "material_change": true, "title_zh": "Bitget 黑客攻击重演熟悉的模式", "title_en": "The Bitget Hack Repeats a Familiar Pattern", "what_changed_zh": "Galaxy Research 分析 Bitget 黑客攻击，显示其遵循了此前在 Bybit 入侵事件中出现的与 Lazarus 相关的相同攻击模式。", "what_changed_en": "Galaxy Research analyzes the Bitget hack, showing it follows the same Lazarus-linked attack pattern previously seen in the Bybit breach.", "current_state_zh": "Galaxy Research 分析 Bitget 黑客攻击，显示其遵循了此前在 Bybit 入侵事件中出现的与 Lazarus 相关的相同攻击模式。", "current_state_en": "Galaxy Research analyzes the Bitget hack, showing it follows the same Lazarus-linked attack pattern previously seen in the Bybit breach.", "detailed_summary_zh": "Galaxy Research analyzes the Bitget hack, showing it follows the same Lazarus-linked attack pattern previously seen in the Bybit breach.", "detailed_summary_en": "Galaxy Research analyzes the Bitget hack, showing it follows the same Lazarus-linked attack pattern previously seen in the Bybit breach.", "background_zh": "2025 年 2 月 21 日，总部位于迪拜的交易所 Bybit 遭入侵，约 15 亿美元的以太坊被盗，被称为史上规模最大的加密货币盗窃案，Chainalysis 将其归因于朝鲜（DPRK）。Lazarus 集团隶属朝鲜侦察总局，至少自 2009 年起活动；安全研究引用的 Chainalysis 数据显示，该组织 2023 年盗取的加密货币超过 17 亿美元。", "background_en": "On February 21, 2025, Dubai-based exchange Bybit suffered a breach in which roughly $1.5 billion in ether was stolen, described as the largest crypto heist on record and attributed by Chainalysis to the DPRK. Lazarus Group operates under North Korea's Reconnaissance General Bureau and has been active since at least 2009; Chainalysis data cited in security research put its 2023 crypto thefts at over $1.7 billion.", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "该事件的核心是交易所热钱包安全与托管风险：Bitget 暂停提现会影响该平台的流动性和用户对资产的提取，而这一规模的朝鲜相关盗窃案也会加剧市场对中心化交易所安全性以及被盗资金追踪与冻结能力的担忧。", "market_impact_en": "The story centers on exchange hot-wallet security and custody risk: withdrawal suspensions at Bitget affect the venue's liquidity and user access to assets, while DPRK-attributed thefts of this scale feed into broader concern about centralized-exchange security and the tracing and freezing of stolen funds.", "importance_score": 8.0, "references": [ { "url": "https://thenextweb.com/news/bitget-hack-351-million-north-korea-hot-wallets", "title": "Bitget suspects North Korean hackers in $351.6m theft from its hot..." }, { "url": "https://cointelegraph.com/news/bitget-ceo-gracy-chen-chances-recovering-funds-security-breach", "title": "Bitget CEO Doubts Full Recovery of $388M Hack Funds" }, { "url": "https://www.chainalysis.com/blog/bybit-exchange-hack-february-2025-crypto-security-dprk/", "title": "Collaboration in the Wake of Record-Breaking Bybit Theft" } ], "confidence": 0.75, "story_ids": [ "google_news:article:3cdbf1ea6dc278cd" ], "sources": [ { "url": "https://www.galaxy.com/insights/research/bitget-hack-lazarus-bybit-pattern", "label": "galaxy.com", "source_type": "google_news", "official": false } ] }, { "update_id": "upd_17d4564bdbcaa5bd", "event_id": "evt_6655595dc1e36e0b", "occurred_at": "2026-10-02T16:10:41Z", "published_at": "2026-10-02T16:10:41Z", "first_seen_at": "2026-10-02T17:58:03.256753Z", "time_precision": "published", "update_type": "confirmation", "material_change": true, "title_zh": "Chainalysis将3.87亿美元Bitget黑客事件与朝鲜关联", "title_en": "Chainalysis Links $387 Million Bitget Hack to North Korea", "what_changed_zh": "Chainalysis 将 3.87 亿美元的 Bitget 黑客攻击归因于与朝鲜有关的黑客，使 2026 年归因于朝鲜的加密货币盗窃金额超过 10 亿美元，链上记录显示被盗的 XRP 通过 THORChain 进行兑换。", "what_changed_en": "Chainalysis attributes the $387 million Bitget hack to North Korea-linked hackers, bringing DPRK-attributed crypto theft above $1 billion in 2026, with on-chain records showing the stolen XRP being swapped through THORChain.", "current_state_zh": "Chainalysis 将 3.87 亿美元的 Bitget 黑客攻击归因于与朝鲜有关的黑客，使 2026 年归因于朝鲜的加密货币盗窃金额超过 10 亿美元，链上记录显示被盗的 XRP 通过 THORChain 进行兑换。", "current_state_en": "Chainalysis attributes the $387 million Bitget hack to North Korea-linked hackers, bringing DPRK-attributed crypto theft above $1 billion in 2026, with on-chain records showing the stolen XRP being swapped through THORChain.", "detailed_summary_zh": "Chainalysis attributes the $387 million Bitget hack to North Korea-linked hackers, bringing DPRK-attributed crypto theft above $1 billion in 2026, with on-chain records showing the stolen XRP being swapped through THORChain.", "detailed_summary_en": "Chainalysis attributes the $387 million Bitget hack to North Korea-linked hackers, bringing DPRK-attributed crypto theft above $1 billion in 2026, with on-chain records showing the stolen XRP being swapped through THORChain.", "background_zh": "", "background_en": "", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "", "market_impact_en": "", "importance_score": 8.5, "references": [], "confidence": 0.75, "story_ids": [ "rss:thedefiant.io_api_feed:62bf3a5d5dc3d647" ], "sources": [ { "url": "https://thedefiant.io/news/hacks/chainalysis-links-387-million-bitget-hack-to-north-korea", "label": "The Defiant", "source_type": "rss", "official": false } ] }, { "update_id": "upd_22bd9ef9809b632c", "event_id": "evt_6655595dc1e36e0b", "occurred_at": "2026-10-03T17:01:03Z", "published_at": "2026-10-03T17:01:03Z", "first_seen_at": "2026-10-03T20:41:59.640858Z", "time_precision": "published", "update_type": "aftermath", "material_change": true, "title_zh": "Chainalysis 利用 AI 将 3.87 亿美元的 Bitget 黑客攻击追溯到朝鲜", "title_en": "Chainalysis Used AI to Trace the $387M Bitget Hack Back to North Korea", "what_changed_zh": "Chainalysis 使用内部 AI 加速追踪，将 20 多小时的手动跨链对账压缩至 10 分钟以内；新报道还补充了 Near Intents 拒绝超 5000 万美元相关兑换后自身遭攻击、THORChain 继续处理、Circle 和 Tether 冻结约 31.8 万美元稳定币等洗钱应对细节。", "what_changed_en": "Chainalysis used in-house AI to accelerate tracing, compressing 20+ hours of manual bridge reconciliation into under 10 minutes; the report also adds laundering response details: Near Intents rejected over $50M in related swaps before being hacked itself, THORChain kept processing, and Circle and Tether froze about $318,000 in stablecoins.", "current_state_zh": "Chainalysis 将 3.87 亿美元的 Bitget 黑客攻击归因于与朝鲜有关的黑客，使 2026 年归因于朝鲜的加密货币盗窃金额超过 10 亿美元，链上记录显示被盗的 XRP 通过 THORChain 进行兑换；Chainalysis 使用内部 AI 加速追踪，且新报道补充 Near Intents 拒绝超 5000 万美元相关兑换后自身遭攻击、THORChain 继续处理、Circle 和 Tether 冻结约 31.8 万美元稳定币。", "current_state_en": "Chainalysis attributes the $387 million Bitget hack to North Korea-linked hackers, bringing DPRK-attributed crypto theft above $1 billion in 2026, with on-chain records showing the stolen XRP being swapped through THORChain; Chainalysis used in-house AI to accelerate tracing, and reporting adds that Near Intents rejected over $50M in related swaps before being hacked, THORChain kept processing, and Circle and Tether froze about $318k in stablecoins.", "detailed_summary_zh": "Chainalysis attributed the $387 million Bitget exchange hack to North Korea-linked actors, using in-house AI to trace the funds across 23 rapid transfers into Ethereum, XRP, Zcash and Tron, pushing Pyongyang's 2026 crypto theft total past $1 billion.", "detailed_summary_en": "Chainalysis attributed the $387 million Bitget exchange hack to North Korea-linked actors, using in-house AI to trace the funds across 23 rapid transfers into Ethereum, XRP, Zcash and Tron, pushing Pyongyang's 2026 crypto theft total past $1 billion.", "background_zh": "转账之后，攻击者通过跨链流动性与消息协议、即时兑换以及洗钱服务转移资金，以掩盖踪迹。被盗的 XRP 被送入一个跨链流动性协议，另一端换出比特币，约一天半时间内数千万美元资金流向目前正被监控的攻击者控制的比特币地址；攻击者还开始将资金藏入 Zcash 的屏蔽池。Near Intents 拒绝了与黑客相关的逾 5000 万美元兑换，几天后自身也遭到攻击，而 Thorchain 继续处理相关交易；Circle 与 Tether 合计冻结了约 31.8 万美元的稳定币。", "background_en": "After the transfers, the attackers ran the funds through cross-chain liquidity and messaging protocols, instant swaps and laundering services to obscure the trail. The stolen XRP was pushed through a cross-chain liquidity protocol with Bitcoin pulled out the other side, moving tens of millions of dollars over roughly a day and a half to attacker-controlled Bitcoin addresses now under watch, and the attacker began hiding funds in Zcash's shielded pool. Near Intents rejected more than $50 million in swaps tied to the hacker and was itself hacked days later, while Thorchain kept processing; Circle and Tether froze roughly $318,000 in stablecoins.", "community_discussion_zh": "", "community_discussion_en": "", "market_impact_zh": "该事件使交易所热钱包安全以及跨链桥／兑换洗钱路径持续受到关注，也显示 Circle、Tether 等稳定币发行方能够冻结与被追踪资金相关的余额，这一渠道会影响中心化交易平台的托管与流动性风险，以及用于转移被盗资产的跨链桥与即时兑换服务。Chainalysis 关于 AI 辅助追踪的说法，也关系到合规与分析服务商能以多快速度标记受污染资金流。", "market_impact_en": "The case keeps exchange hot-wallet security and cross-chain bridge/swap laundering routes in focus, and shows that stablecoin issuers such as Circle and Tether can freeze balances tied to traced funds — a channel that affects custody and liquidity risk for centralized venues and for the bridge and instant-swap services used to move stolen assets. Chainalysis's AI-assisted tracing claim also bears on how quickly tainted flows can be flagged by compliance and analytics providers.", "importance_score": 7.0, "references": [ { "url": "https://www.chainalysis.com/", "title": "The Blockchain Data Platform - Chainalysis" }, { "url": "https://z.cash/", "title": "Zcash: Privacy-protecting digital currency" }, { "url": "https://tron.network/", "title": "TRON Network | Decentralize The Web" } ], "confidence": 0.95, "story_ids": [ "rss:decrypt.co_feed:163fa23df78dce0e" ], "sources": [ { "url": "https://decrypt.co/380005/chainalysis-ai-87m-bitget-hack-north-korea", "label": "Decrypt", "source_type": "rss", "official": false } ] } ] }