Overview
- Bitget says attackers exploited a vulnerability in a third-party security product on Sept. 24 to submit forged withdrawal commands without stealing private keys or touching cold wallets.
- Investigators and on‑chain analysts report roughly $387.5 million was taken and that about $342 million remained in attacker-controlled wallets after tracing, with roughly 3,386 BTC concentrated as of late September.
- Security firms traced large pass-through flows through cross-chain services, with BlockSec estimating about $269 million moved via THORChain before consolidation into Bitcoin and subsequent use of mixers like CoinJoin.
- Issuers and protocols froze only about $840,000 in linked funds, and THORChain declined Bitget’s request to block attacker addresses, which analysts say shows limits to selective freezes on decentralized rails.
- Attribution is contested: Chainalysis links most stolen XRP to DPRK-associated activity but law enforcement has not publicly confirmed that finding; Bitget says its $464 million protection fund will cover customer losses and has opened a bounty and forensic hunt for recoveries.