{"investigation":{"slug":"bitget-exchange-september-2026-backend-hack-387-5m","entity_name":"Bitget Exchange — September 2026 Backend Hack ($387.5M)","trust_score":0,"severity_base":null,"score_modifier":-19.6,"confidence":0.82,"status":"published","content_type":"investigation","summary":"On September 24-25, 2026, attackers stole approximately $387.5 million from Bitget's hot and warm wallets after exploiting a zero-day vulnerability in two third-party security appliances, according to Bitget and forensic reviews by SlowMist and Google Cloud's Mandiant. Bitget CEO Gracy Chen said the attack was \"very likely\" carried out by North Korea-linked hackers, citing IP addresses, behavioral patterns and on-chain signatures, while researcher ZachXBT separately identified five alleged Chinese operators he said were laundering the stolen funds on behalf of North Korean actors. Bitget halted withdrawals, pledged to cover losses from a User Protection Fund exceeding $464 million, and restored that fund above $300 million by September 30, 2026; recovery of the stolen assets themselves remains limited.","sections":[{"content":"Bitget disclosed that attackers drained funds from its hot and warm wallets beginning September 24, 2026, with blockchain security firms observing more than $175 million leave the platform that day before further transfers followed. Bitget initially estimated the loss at approximately $351.6 million, later revising the figure upward to approximately $387.5 million after identifying additional affected transfers involving Zcash (ZEC) and TRON (TRX) assets. The incident affected 11 blockchains. Bitget suspended withdrawals platform-wide while investigating, then reopened them in phases: USDT withdrawals on Ethereum, BSC, Solana and Tron resumed around September 30, with the remaining assets, fiat and peer-to-peer services scheduled to reopen October 2, 2026 at 08:00 UTC. CEO Gracy Chen said the exchange's User Protection Fund, which she described as holding over $464 million, would be used to cover user losses, and compared the exchange's position favorably to Bybit's ability to absorb a $1.5 billion loss in 2025. Bitget said on September 30 that the fund had been restored above $300 million, ahead of its stated one-week target; this replenishment of the fund is distinct from recovery of the stolen assets themselves.","heading":"Incident Overview and Financial Impact","sources":[{"url":"https://www.bleepingcomputer.com/news/security/bitget-hacked-via-zero-day-in-third-party-security-products/","name":"Bitget hacked via zero-day in third-party security products","type":"news_article","credibility":2},{"url":"https://therecord.media/crypto-ceo-accuses-north-korea-of-387-million-theft","name":"Crypto CEO accuses North Korea of $387 million theft","type":"news_article","credibility":1},{"url":"https://www.cryptotimes.io/2026/09/30/bitget-protection-fund-back-above-300m-after-387-5m-hack-p2p-withdrawals-return-october-2/","name":"Bitget protection fund back above $300M after $387.5M hack, P2P withdrawals return October 2","type":"news_article","credibility":2},{"url":"https://cryptoslate.com/bitget-restores-300m-fund-after-absorbing-388m-security-breach/","name":"Bitget restores $300M fund after absorbing $388M security breach","type":"news_article","credibility":2},{"url":"https://www.cnbc.com/2026/09/25/crypto-platform-bitget-suspects-north-korea-in-352-million-hack.html","name":"Crypto platform Bitget suspects North Korea in $352 million hack","type":"news_article","credibility":1}],"severity":"critical"},{"content":"Forensic investigations by blockchain security firm SlowMist and Google Cloud's incident-response arm Mandiant, commissioned by Bitget, found that the intrusion began well before the theft was executed. SlowMist said the earliest malicious activity it could identify in available logs dated to August 31, 2026, when an attacker exploited a zero-day vulnerability affecting a third-party security product it referred to only as \"Product A,\" using a hidden script to retrieve a database password from an environment variable. Mandiant separately reported that a threat actor gained unauthorized privileged access to two of Bitget's third-party security appliances, which it labeled Appliance A and Appliance B, and placed a web shell on Appliance B before moving laterally to Bitget's production wallet job server, where malicious packages were deployed. SlowMist reported further suspicious activity on two other nodes on September 23 and September 25, including, on September 25, the attacker's use of an internal employee's identity to access a second product's management platform (\"Product B\"), followed by attempted command injection, configuration changes and malicious file uploads. The attackers used a custom withdrawal tool, later recovered by SlowMist, to issue fraudulent withdrawal commands that bypassed Bitget's existing risk controls; the actual theft transfers began shortly after midnight on September 25, 2026, with the earliest verified transfer recorded at 02:31 UTC+8 and transfer activity spanning roughly two to three hours. Neither Bitget, SlowMist nor Mandiant has publicly named the vendors of the compromised security appliances, and Bitget said it had notified the relevant vendor and disabled the affected functionality pending a fix. Bitget stated the attackers did not obtain private keys for hot, warm or cold wallets and did not forge individual user withdrawal requests.","heading":"Zero-Day Root Cause and Attack Timeline","sources":[{"url":"https://cointelegraph.com/news/bitget-hack-zero-day-slowmist-investigation","name":"Bitget hack zero-day SlowMist investigation","type":"news_article","credibility":2},{"url":"https://www.bleepingcomputer.com/news/security/bitget-hacked-via-zero-day-in-third-party-security-products/","name":"Bitget hacked via zero-day in third-party security products","type":"news_article","credibility":2},{"url":"https://www.cryptotimes.io/2026/09/30/bitget-387-5m-hack-slowmist-and-mandiant-say-zero-day-attack-began-weeks-before-theft/","name":"Bitget $387.5M hack: SlowMist and Mandiant say zero-day attack began weeks before theft","type":"news_article","credibility":2},{"url":"https://news.bitcoin.com/security/bitget-hack-slowmist-25-days-chainflip-cow-protocol/","name":"Bitget hack: SlowMist says hackers were inside the exchange for 25 days, traced funds through Chainflip and CoW Protocol","type":"news_article","credibility":2},{"url":"https://thehackernews.com/2026/10/bitget-confirms-third-party-zero-day.html","name":"Bitget confirms third-party zero day","type":"news_article","credibility":2}],"severity":"critical"},{"content":"Bitget CEO Gracy Chen said she believed North Korean-linked hackers were \"very likely\" responsible for the attack, citing IP addresses associated with VPN services previously used by North Korean threat groups, behavioral patterns, and on-chain analysis, while stopping short of formal confirmation. Bitget said it had notified relevant authorities and was cooperating with them globally. Blockchain analytics firm Elliptic reported that funds stolen in the Bitget hack moved through addresses previously used to launder proceeds of the 2025 Bybit theft, which U.S. and South Korean authorities and multiple blockchain-analysis firms have attributed to North Korea's Lazarus Group / TraderTraitor. As of this writing, no government agency has issued a formal, independent attribution naming a specific North Korean unit in the Bitget case; the attribution rests primarily on Bitget's own statement and on circumstantial on-chain and infrastructure overlaps identified by private investigators, and should be treated as alleged pending law-enforcement or intelligence-agency confirmation.","heading":"Suspected North Korean Attribution","sources":[{"url":"https://therecord.media/crypto-ceo-accuses-north-korea-of-387-million-theft","name":"Crypto CEO accuses North Korea of $387 million theft","type":"news_article","credibility":1},{"url":"https://www.cnbc.com/2026/09/25/crypto-platform-bitget-suspects-north-korea-in-352-million-hack.html","name":"Crypto platform Bitget suspects North Korea in $352 million hack","type":"news_article","credibility":1},{"url":"https://expertinsights.com/news/crypto-platform-bitget-hacked-for-387m","name":"North Korean Hackers Steal $387.5m From Crypto Platform Bitget Using A Zero-Day Flaw","type":"news_article","credibility":2}],"severity":"high"},{"content":"On September 28, 2026, on-chain investigator ZachXBT published online identities for five individuals he alleged were laundering funds stolen in the Bitget hack, using the aliases Cc, jack, Melon, lolo (also referenced as Marin), and HELP ME. For each, he published Discord or Telegram handles together with associated THORChain swap transaction hashes. According to reporting on his findings, the operators were observed in public chat channels openly seeking help, including asking platform staff to check \"stuck\" XRP-to-BTC swaps and opening support tickets, which investigators used to help identify them. ZachXBT described the five as Chinese-based illicit actors allegedly working on behalf of North Korean operators, and reporting noted that one of the named accounts, \"lolo,\" had previously been linked to laundering proceeds of the unrelated $292 million Kelp DAO exploit in April 2026. These identifications rest on ZachXBT's independent, non-governmental research and associated secondary reporting; they have not been confirmed by law enforcement and should be treated as alleged.","heading":"ZachXBT: Alleged Chinese Launderers Linked to the Theft","sources":[{"url":"https://www.cryptotimes.io/2026/09/28/zachxbt-exposes-5-launderers-moving-387-5m-bitget-hack-funds-for-north-korea/","name":"ZachXBT exposes 5 launderers moving $387.5M Bitget hack funds for North Korea","type":"news_article","credibility":2},{"url":"https://www.mitrade.com/insights/news/live-news/article-3-2121039-20260928","name":"Investigator Finds $387M Bitget Hack Suspects Asking for Help in Public Chats","type":"news_article","credibility":2},{"url":"https://decrypt.co/380092/zachxbt-fronted-350k-pose-client-lazarus-chinese-crypto-launderers","name":"Crypto Sleuth ZachXBT Fronted $350K to Pose as a Client of Lazarus' Chinese Launderers","type":"news_article","credibility":2}],"severity":"high"},{"content":"SlowMist's analysis described attackers using automated scripts to place CoW Protocol swap orders naming pre-generated Chainflip deposit addresses as recipients, with Chainflip then executing cross-chain swaps converting the proceeds into bitcoin, after which CoinJoin mixing was used to further obscure the funds' trail. Chainflip said its brokers had rejected a direct deposit attempt from the same attacker-controlled addresses a day earlier and returned the funds, while SlowMist warned that automated transaction fragmentation could allow the operators to attempt alternate routes after such rejections. A blockchain researcher's tally found that liquidity providers and services profited from the laundering activity, with THORChain liquidity providers receiving an estimated $573,226 in fees from related swaps, MetaMask collecting approximately $149,417, Chainflip about $26,751, and CoW Protocol's EthFlow about $12,332. NEAR Intents said its SHIELD monitoring system halted over $50 million in attempted laundering tied to the hack, though only about $503,000 was actually frozen and roughly $166,000 reportedly moved through before detection; Bitget had offered a 5% recovery bounty for frozen funds, which NEAR Intents said it waived. Stablecoin issuers Tether and Circle reportedly froze several hundred thousand dollars in related funds, with figures in different reports ranging from roughly $320,000 to $1.1 million combined across issuers and platforms. Bitget's CEO separately asked THORChain to block the parties moving the stolen funds; THORChain said it would not do so, citing its decentralized, permissionless design. Days after freezing funds related to the Bitget theft, NEAR Intents itself was separately exploited for approximately $3.8 million through a bug in its Omni deposit and withdrawal infrastructure; it said it would reimburse affected users in full, an incident distinct from, though temporally linked to, the Bitget case.","heading":"Laundering Routes: CoW Protocol, Chainflip, NEAR Intents and THORChain","sources":[{"url":"https://news.bitcoin.com/security/bitget-hack-slowmist-25-days-chainflip-cow-protocol/","name":"Bitget hack: SlowMist says hackers were inside the exchange for 25 days, traced funds through Chainflip and CoW Protocol","type":"news_article","credibility":2},{"url":"https://cryptopotato.com/stolen-bitget-funds-converted-to-btc-via-cow-chainflip-report/","name":"Stolen Bitget Funds Converted to BTC via CoW, Chainflip: Report","type":"news_article","credibility":2},{"url":"https://www.cryptopolitan.com/bitget-laundering-near-intents-chainflip/","name":"Bitget laundering routes through NEAR Intents and Chainflip","type":"news_article","credibility":2},{"url":"https://thedefiant.io/news/hacks/near-intents-says-it-froze-503-000-in-bitget-hack-funds","name":"NEAR Intents says it froze $503,000 in Bitget hack funds","type":"news_article","credibility":2},{"url":"https://protos.com/near-intents-hacked-days-after-freezing-stolen-bitget-funds/","name":"NEAR Intents hacked days after freezing stolen Bitget funds","type":"news_article","credibility":2},{"url":"https://crypto.news/bitget-hack-laundering-generated-761725-in-fees-researcher-finds/","name":"Bitget hack laundering generated $761,725 in fees, researcher finds","type":"news_article","credibility":2}],"severity":"medium"},{"content":"The alleged North Korean attribution in the Bitget case sits within a wider pattern of large-scale cryptocurrency theft attributed to DPRK-linked groups in 2026. Blockchain analytics firm TRM Labs reported that North Korea-linked actors stole approximately $643 million in the first half of 2026 alone, roughly 66% of all cryptocurrency stolen globally in that period, while a separate analysis from Blockaid put the North Korea-linked figure closer to $609 million, or about 55% of roughly $1.1 billion in verified exploits over the same window. A United Nations panel has previously estimated North Korea has stolen more than $3 billion in cryptocurrency since 2017. Other major 2026 incidents attributed with varying confidence to DPRK-linked actors include the approximately $285 million Drift Protocol exploit and the approximately $290 million Kelp DAO exploit, both in April 2026, as well as the 2025 Bybit theft of roughly $1.5 billion, to which Elliptic linked some Bitget-hack laundering infrastructure. These figures come from private blockchain-intelligence firms rather than government attribution and should be read as industry estimates.","heading":"Broader Context: DPRK Crypto Theft in 2026","sources":[{"url":"https://cryptobriefing.com/north-korea-hackers-steal-643m-crypto-h1-2026/","name":"North Korea-linked hackers steal $643M in crypto in H1 2026","type":"research","credibility":2},{"url":"https://www.nknews.org/pro/north-korea-drove-over-half-of-global-crypto-theft-in-first-half-of-2026-report/","name":"North Korea drove over half of global crypto theft in first half of 2026: report","type":"news_article","credibility":2}],"severity":"medium"},{"content":"Several aspects of the incident remain unresolved as of this writing. SlowMist and Mandiant have not publicly named the vendors of the two compromised third-party security appliances, referring to them only as \"Product A\"/\"Appliance A\" and \"Product B\"/\"Appliance B.\" Loss figures have varied across reports and over time, with Bitget's own estimate revised from approximately $351.6 million to approximately $387.5 million, and secondary outlets citing both figures inconsistently. Reported frozen-fund totals also vary between sources, from roughly $503,000 (NEAR Intents alone) to figures approaching $1.1 million when combined with stablecoin-issuer freezes. CEO Gracy Chen said she was \"not very optimistic\" about recovering the stolen assets, drawing a comparison to the limited recovery achieved after Bybit's 2025 theft. No government or law-enforcement agency had, as of this writing, issued a confirmed, formal attribution of the Bitget hack to a specific North Korean entity; the North Korea attribution and the identification of the alleged Chinese laundering operators both rest on private-sector and independent-researcher analysis rather than confirmed law-enforcement findings.","heading":"Unresolved Questions and Investigation Status","sources":[{"url":"https://www.bleepingcomputer.com/news/security/bitget-hacked-via-zero-day-in-third-party-security-products/","name":"Bitget hacked via zero-day in third-party security products","type":"news_article","credibility":2},{"url":"https://thehackernews.com/2026/10/bitget-confirms-third-party-zero-day.html","name":"Bitget confirms third-party zero day","type":"news_article","credibility":2}],"severity":"medium"}],"timeline":[{"date":"2026-08","event":"SlowMist later identifies this as the earliest logged malicious activity against a compromised third-party security appliance (\"Product A\").","source":"Cointelegraph","source_url":"https://cointelegraph.com/news/bitget-hack-zero-day-slowmist-investigation","date_evidence":"SlowMist traces the earliest logged malicious activity to Aug. 31, when an attacker exploited a zero-day vulnerability affecting a third-party security product.","date_original":"2026-08-31"},{"date":"2026-09","event":"SlowMist reports similar suspicious activity detected on two other nodes.","source":"BleepingComputer","source_url":"https://www.bleepingcomputer.com/news/security/bitget-hacked-via-zero-day-in-third-party-security-products/","date_original":"2026-09-23"},{"date":"2026-09-24","event":"Mandiant's investigation finds the threat actor gained unauthorized privileged access to Bitget's third-party security appliances A and B and placed a web shell on Appliance B.","source":"BleepingComputer","source_url":"https://www.bleepingcomputer.com/news/security/bitget-hacked-via-zero-day-in-third-party-security-products/","date_evidence":"Mandiant states 'on September 24, 2026, a threat actor gained unauthorised privileged access' to Bitget's security appliances."},{"date":"2026-09","event":"Attackers use a custom withdrawal tool to execute unauthorized transfers from Bitget's hot and warm wallets; the earliest verified theft transfer occurs at 02:31 UTC+8, with activity spanning roughly two to three hours. Bitget suspends withdrawals.","source":"Cointelegraph / BleepingComputer","source_url":"https://cointelegraph.com/news/bitget-hack-zero-day-slowmist-investigation","date_evidence":"the earliest transfer verified to date at 2:31 am UTC+8 on Sept. 25","date_original":"2026-09-25"},{"date":"2026-09","event":"Bitget CEO Gracy Chen publicly states North Korean-linked hackers are the likely perpetrators, citing IP, behavioral and on-chain evidence; initial loss estimate given as approximately $351.6 million (also reported as roughly $352 million).","source":"The Record / CNBC","source_url":"https://therecord.media/crypto-ceo-accuses-north-korea-of-387-million-theft","date_original":"2026-09-25"},{"date":"2026-09","event":"Researcher ZachXBT publishes online identities of five alleged operators (aliases Cc, jack, Melon, lolo/Marin, HELP ME) he says are laundering the stolen funds, describing them as Chinese actors allegedly working for North Korean operators.","source":"CryptoTimes","source_url":"https://www.cryptotimes.io/2026/09/28/zachxbt-exposes-5-launderers-moving-387-5m-bitget-hack-funds-for-north-korea/","date_original":"2026-09-28"},{"date":"2026-09","event":"Bitget and SlowMist publish updated findings revising the loss estimate to approximately $387.5 million after identifying additional affected Zcash and TRON transfers; Bitget says its User Protection Fund has been restored above $300 million and resumes USDT withdrawals on several chains.","source":"CryptoTimes","source_url":"https://www.cryptotimes.io/2026/09/30/bitget-387-5m-hack-slowmist-and-mandiant-say-zero-day-attack-began-weeks-before-theft/","date_original":"2026-09-30"},{"date":"2026-10","event":"Bitget's published timetable targets this date for resuming remaining cryptocurrency, fiat and peer-to-peer withdrawal services.","source":"CryptoTimes","source_url":"https://www.cryptotimes.io/2026/09/30/bitget-protection-fund-back-above-300m-after-387-5m-hack-p2p-withdrawals-return-october-2/","date_original":"2026-10-02"},{"date":"2026-10","event":"Bitget publicly confirms the zero-day flaw in third-party security products as the root cause of the breach.","source":"The Hacker News","source_url":"https://thehackernews.com/2026/10/bitget-confirms-third-party-zero-day.html"}],"sources_used":[{"url":"https://www.bleepingcomputer.com/news/security/bitget-hacked-via-zero-day-in-third-party-security-products/","name":"Bitget hacked via zero-day in third-party security products","type":"news_article","archive_url":"http://web.archive.org/web/20261030190725/https://www.bleepingcomputer.com/news/security/bitget-hacked-via-zero-day-in-third-party-security-products/","credibility":2,"archive_timestamp":"2026-10-30T19:07:25+00:00"},{"url":"https://thehackernews.com/2026/10/bitget-confirms-third-party-zero-day.html","name":"Bitget confirms third-party zero day","type":"news_article","archive_url":"http://web.archive.org/web/20261102135953/https://thehackernews.com/2026/10/bitget-confirms-third-party-zero-day.html","credibility":2,"archive_timestamp":"2026-11-02T13:59:53+00:00"},{"url":"https://cointelegraph.com/news/bitget-hack-zero-day-slowmist-investigation","name":"Bitget hack zero-day SlowMist investigation","type":"news_article","archive_url":"http://web.archive.org/web/20261102135250/https://cointelegraph.com/news/bitget-hack-zero-day-slowmist-investigation","credibility":2,"archive_timestamp":"2026-11-02T13:52:50+00:00"},{"url":"https://www.cryptotimes.io/2026/09/30/bitget-387-5m-hack-slowmist-and-mandiant-say-zero-day-attack-began-weeks-before-theft/","name":"Bitget $387.5M hack: SlowMist and Mandiant say zero-day attack began weeks before theft","type":"news_article","archive_url":"http://web.archive.org/web/20261019165247/https://www.cryptotimes.io/2026/09/30/bitget-387-5m-hack-slowmist-and-mandiant-say-zero-day-attack-began-weeks-before-theft/","credibility":2,"archive_timestamp":"2026-10-19T16:52:47+00:00"},{"url":"https://www.cryptotimes.io/2026/09/28/zachxbt-exposes-5-launderers-moving-387-5m-bitget-hack-funds-for-north-korea/","name":"ZachXBT exposes 5 launderers moving $387.5M Bitget hack funds for North Korea","type":"news_article","archive_url":"http://web.archive.org/web/20261019171421/https://www.cryptotimes.io/2026/09/28/zachxbt-exposes-5-launderers-moving-387-5m-bitget-hack-funds-for-north-korea/","credibility":2,"archive_timestamp":"2026-10-19T17:14:21+00:00"},{"url":"https://news.bitcoin.com/security/bitget-hack-slowmist-25-days-chainflip-cow-protocol/","name":"Bitget hack: SlowMist says hackers were inside the exchange for 25 days, traced funds through Chainflip and CoW Protocol","type":"news_article","archive_url":"http://web.archive.org/web/20261024200827/https://news.bitcoin.com/security/bitget-hack-slowmist-25-days-chainflip-cow-protocol/","credibility":2,"archive_timestamp":"2026-10-24T20:08:27+00:00"},{"url":"https://www.cryptopolitan.com/bitget-laundering-near-intents-chainflip/","name":"Bitget laundering routes through NEAR Intents and Chainflip","type":"news_article","archive_url":"http://web.archive.org/web/20260930162146/https://www.cryptopolitan.com/bitget-laundering-near-intents-chainflip/","credibility":2,"archive_timestamp":"2026-09-30T16:21:46+00:00"},{"url":"https://therecord.media/crypto-ceo-accuses-north-korea-of-387-million-theft","name":"Crypto CEO accuses North Korea of $387 million theft","type":"news_article","archive_url":"http://web.archive.org/web/20261102141141/https://therecord.media/crypto-ceo-accuses-north-korea-of-387-million-theft","credibility":1,"archive_timestamp":"2026-11-02T14:11:41+00:00"},{"url":"https://www.cnbc.com/2026/09/25/crypto-platform-bitget-suspects-north-korea-in-352-million-hack.html","name":"Crypto platform Bitget suspects North Korea in $352 million hack","type":"news_article","archive_url":"http://web.archive.org/web/20261031100210/https://www.cnbc.com/2026/09/25/crypto-platform-bitget-suspects-north-korea-in-352-million-hack.html","credibility":1,"archive_timestamp":"2026-10-31T10:02:10+00:00"},{"url":"https://www.cryptotimes.io/2026/09/30/bitget-protection-fund-back-above-300m-after-387-5m-hack-p2p-withdrawals-return-october-2/","name":"Bitget protection fund back above $300M after $387.5M hack, P2P withdrawals return October 2","type":"news_article","archive_url":"http://web.archive.org/web/20260930111151/https://www.cryptotimes.io/2026/09/30/bitget-protection-fund-back-above-300m-after-387-5m-hack-p2p-withdrawals-return-october-2/","credibility":2,"archive_timestamp":"2026-09-30T11:11:51+00:00"},{"url":"https://cryptoslate.com/bitget-restores-300m-fund-after-absorbing-388m-security-breach/","name":"Bitget restores $300M fund after absorbing $388M security breach","type":"news_article","archive_url":"http://web.archive.org/web/20261007181156/https://cryptoslate.com/bitget-restores-300m-fund-after-absorbing-388m-security-breach/","credibility":2,"archive_timestamp":"2026-10-07T18:11:56+00:00"},{"url":"https://cryptopotato.com/stolen-bitget-funds-converted-to-btc-via-cow-chainflip-report/","name":"Stolen Bitget Funds Converted to BTC via CoW, Chainflip: Report","type":"news_article","archive_url":"http://web.archive.org/web/20261003083153/https://cryptopotato.com/stolen-bitget-funds-converted-to-btc-via-cow-chainflip-report/","credibility":2,"archive_timestamp":"2026-10-03T08:31:53+00:00"},{"url":"https://thedefiant.io/news/hacks/near-intents-says-it-froze-503-000-in-bitget-hack-funds","name":"NEAR Intents says it froze $503,000 in Bitget hack funds","type":"news_article","archive_url":"http://web.archive.org/web/20261003015345/https://thedefiant.io/news/hacks/near-intents-says-it-froze-503-000-in-bitget-hack-funds","credibility":2,"archive_timestamp":"2026-10-03T01:53:45+00:00"},{"url":"https://protos.com/near-intents-hacked-days-after-freezing-stolen-bitget-funds/","name":"NEAR Intents hacked days after freezing stolen Bitget funds","type":"news_article","archive_url":"http://web.archive.org/web/20261024043036/https://protos.com/near-intents-hacked-days-after-freezing-stolen-bitget-funds/","credibility":2,"archive_timestamp":"2026-10-24T04:30:36+00:00"},{"url":"https://crypto.news/bitget-hack-laundering-generated-761725-in-fees-researcher-finds/","name":"Bitget hack laundering generated $761,725 in fees, researcher finds","type":"news_article","archive_url":"http://web.archive.org/web/20261014231033/https://crypto.news/bitget-hack-laundering-generated-761725-in-fees-researcher-finds/","credibility":2,"archive_timestamp":"2026-10-14T23:10:33+00:00"},{"url":"https://www.mitrade.com/insights/news/live-news/article-3-2121039-20260928","name":"Investigator Finds $387M Bitget Hack Suspects Asking for Help in Public Chats","type":"news_article","archive_url":null,"credibility":2,"archive_timestamp":null},{"url":"https://decrypt.co/380092/zachxbt-fronted-350k-pose-client-lazarus-chinese-crypto-launderers","name":"Crypto Sleuth ZachXBT Fronted $350K to Pose as a Client of Lazarus' Chinese Launderers","type":"news_article","archive_url":"http://web.archive.org/web/20261021093417/https://decrypt.co/380092/zachxbt-fronted-350k-pose-client-lazarus-chinese-crypto-launderers","credibility":2,"archive_timestamp":"2026-10-21T09:34:17+00:00"},{"url":"https://expertinsights.com/news/crypto-platform-bitget-hacked-for-387m","name":"North Korean Hackers Steal $387.5m From Crypto Platform Bitget Using A Zero-Day Flaw","type":"news_article","archive_url":null,"credibility":2,"archive_timestamp":null},{"url":"https://cryptobriefing.com/north-korea-hackers-steal-643m-crypto-h1-2026/","name":"North Korea-linked hackers steal $643M in crypto in H1 2026","type":"research","archive_url":"http://web.archive.org/web/20261014145953/https://cryptobriefing.com/north-korea-hackers-steal-643m-crypto-h1-2026/","credibility":2,"archive_timestamp":"2026-10-14T14:59:53+00:00"},{"url":"https://www.nknews.org/pro/north-korea-drove-over-half-of-global-crypto-theft-in-first-half-of-2026-report/","name":"North Korea drove over half of global crypto theft in first half of 2026: report","type":"news_article","archive_url":"http://web.archive.org/web/20260729170059/https://www.nknews.org/pro/north-korea-drove-over-half-of-global-crypto-theft-in-first-half-of-2026-report/","credibility":2,"archive_timestamp":"2026-07-29T17:00:59+00:00"}],"source_tags":[],"addresses":[],"reviewed":true,"reviewed_by":null,"model_used":"claude-code-investigator","created_at":"2026-09-29T12:05:14.68682+00:00","updated_at":"2026-11-12T21:22:45.954191+00:00"},"source_quality":{"total":20,"tier1":0,"tier2":3,"tier3":0,"unrated":17},"follower_count":null,"content_updated_at":"2026-11-03T23:18:10.696Z","last_fact_checked_at":"2026-10-28T00:46:28.637Z","fact_check_next_allowed_at":null,"update_next_allowed_at":null}