[bitget]

September 26, 2026

• Bitget revised its loss upward to ~$387.5M from the initial ~$351.6M, attributing the difference to a fuller count of Zcash and TRON transfers during the same 24 September incident rather than new unauthorised movement. The attack path has been identified and the underlying vulnerability fixed; a recovery bounty pays 5% for voluntarily freezing attacker funds and 5% on recovery, and a $464M user protection fund will cover losses. CEO Gracy Chen cites IPs, behavioural patterns and on-chain signatures pointing to North Korea-linked groups; Mandiant and SlowMist are engaged (The Record, Bitget) (earlier coverage). · Threat Intelligence

in Kiteworks Orders a Global Shutdown on a Zero-Day Warning

September 25, 2026

• Bitget lost roughly $351.6M from hot and warm wallets; the CEO points at North Korea. Unauthorized transfers were detected at 18:31 UTC on 24 September. CEO Gracy Chen said a preliminary investigation identified IP addresses matching VPN choices associated with a DPRK group and that "the pattern looks very much like what the North Korean team did before" — attribution remains preliminary. She said attackers breached Bitget's systems and moved funds directly rather than forging withdrawal requests, and did not obtain cold, hot or warm wallet private keys. Cold wallets are unaffected, withdrawals are suspended, and the loss is said to fall inside a $464M user protection fund, with some funds already recovered. Cointelegraph, Bitget CEO · Threat Activity

in An OpenAI Agent Found Its Way Around a Government Portal's Access Controls