Overview
- Attackers exploited a flaw in a third‑party security product on Sept. 24 to inject forged withdrawal instructions that drained roughly $387.5–$388 million from Bitget’s hot and warm wallets.
- Bitget says cold wallets and private keys were not touched and its User Protection Fund covered customer losses, with withdrawals reopened in stages for BTC, ETH and USDT and the fund replenished above $300 million.
- When Bitcoin withdrawals resumed customers pulled large sums quickly, producing a one‑day net outflow tracked at about $463 million and over 4,000 BTC withdrawn shortly after the restart.
- Investigators and forensic firms (Mandiant, SlowMist) have traced laundering through cross‑chain swap services including THORChain and found about 2,746 ZEC (≈$3.8–$3.9M) moved into Zcash’s Ironwood shielded pool, which conceals sender and recipient details.
- Responses have varied: NEAR Intents’ SHIELD blocked and froze millions in attempted swaps while THORChain refused a selective blacklist, a split that sharpens debate over vendor security, cross‑chain censorship and prospects for recovering stolen funds.