Search This Blog
Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Load More
Trendy Right Now

Popular Posts

Showing posts with label Crypto Breach. Show all posts
North Korea
bitget Crypto Breach cryptocurrency Cyber Crime Hackers Lazarus Group North Korea

Bitget Hack Climbs to $387.5 Million as Exchange Launches Recovery Bounty and Points to North Korea

 



Crypto exchange Bitget confirmed on September 25 that hackers stole approximately $387.5 million from its hot and warm wallets a day earlier, revising an initial estimate upward as investigators traced funds across multiple blockchains and accounting for assets on Zcash and TRON that were missed in the first tally. The exchange has since launched a structured bounty program for anyone who helps freeze or recover stolen funds, and has brought in independent cybersecurity firms Mandiant and SlowMist to assist with the investigation.

Bitget's security systems first flagged the unauthorized transfers at 18:31 UTC on September 24. By the time the exchange confirmed the breach publicly, the damage figure had already reached $351.6 million. The revised total of $387.5 million reflects a more complete accounting of transfers that occurred during the incident, adding affected assets on Zcash and TRON not captured in the initial estimate. The exchange confirmed no further unauthorized transfers occurred after the incident was contained.


How the Attack Worked

Bitget CEO Gracy Chen clarified that attackers did not steal private keys or forge user withdrawal requests. Instead, they broke into a backend system inside Bitget's wallet infrastructure and used it to spoof transaction data, tricking the exchange's own authorization process into approving payouts that looked routine.

The mechanics were methodical. The attacker's first transfer was a small 0.84 ETH test payment to a fresh address, after which Bitget's main Ethereum hot wallet made roughly 380 transactions during the attack. Every time the hot wallets refilled from the warm wallet layer, the attacker drained them again. The warm wallet, which normally only pays the exchange's own hot wallets, sent 13,966 ETH worth approximately $37 million to an address less than an hour old, with no approved list check and no secondary authorization on a wallet holding over $40 million.

The single largest piece of the haul was roughly 103 million XRP, valued at approximately $157 million at the time of the theft. About $75 million of the stolen funds were held in stablecoins including USDT and USDC.

Some of that ETH moved quickly into mixers: on-chain analysis shows around 6,300 ETH, close to $19 million, funneled through Tornado Cash within hours of the breach.

The confirmed affected assets span XRP, ETH, USDT, ZEC, USDC, USDT0, XAUt, BNB, AVAX and TRX, spread across Ethereum and several EVM-compatible networks, the XRP Ledger, Zcash, and TRON.


User Funds and the Protection Fund

Bitget operates a three-tier wallet architecture, and the breach touched only portions of the hot and warm wallet layers. Cold wallets remained fully secure throughout the attack. Bitget's User Protection Fund, which holds more than $464 million, will cover the full loss, meaning customer account balances stay intact even though the funds themselves were taken. The protection fund was set aside in 2023 specifically to cover hacks and theft so users would not absorb the impact.


North Korea in the Frame

During a three-hour livestream on X, CEO Gracy Chen said Bitget suspects North Korean attackers exploited the backend authentication system, making fraudulent withdrawals appear legitimate. Chen added that she has personally been targeted by the same group before, losing about $80,000 from a personal wallet unconnected to Bitget. North Korea's Lazarus Group, also tracked under the codename TraderTraitor, has been blamed for the industry's biggest thefts, including Bybit's $1.4 billion hack in February 2025, which the FBI confirmed weeks later was North Korean work.


The Recovery Bounty

Bitget has launched a Recovery Bounty Program covering eligible voluntary actions that have already resulted in affected funds being frozen, as well as future actions that directly contribute to freezing or recovering funds. The structure is straightforward: 5% of successfully frozen funds goes to the eligible person or entity whose efforts directly caused the freeze, and 5% of successfully recovered funds is available on the same terms. Bitget will also use Bybit's LazarusBounty initiative as a core channel for the effort.

To support the hunt, Bitget published a real-time fund tracing dashboard at trace.bgblockchain.xyz, an API tracking attacker-controlled addresses updated continuously, and a submission portal for anyone with freezing or recovery information. Exchanges, stablecoin issuers, bridges, custodians, and other infrastructure providers have been encouraged to monitor the flagged addresses and report relevant information through the recovery portal.

The attack is the largest cryptocurrency breach of the year to date and lands in an already turbulent stretch for the industry. Earlier in September, Liquid Network suffered a $319 million security breach, and in late July, hardware wallet maker Coldcard was hit in a separate incident that drained around $116 million in Bitcoin.

Bitget said it will publish a full incident report including root-cause analysis once technical teams complete remediation. Withdrawal restoration was expected to be announced by September 26, 4:00 AM UTC.


Read more »
Data Leak
Crypto Breach Crypto Exchange Crypto Firms Data Breach Data Leak

Confidential Report Highlights Bitfinex Security Breach in Massive 2016 Hack

 

In 2016, a hacker or hackers gained access to the Bitfinex cryptocurrency exchange and took 119,754 bitcoins worth a total of $72 million. The stolen coins' worth had risen to almost $4 billion by the time US police detained rapper Heather Morgan and her husband, startup founder Ilya Lichtenstein, last year on suspicion of laundering them. The US Department of Justice's single greatest recovery in its history. However, the hack's culprit is still at large.

Ledger Labs, a Canadian cryptocurrency consulting and development company, was hired by one of Bitfinex's owners, iFinex, to conduct an investigation. The secret report from that inquiry was never made public. However, a copy of the study with specific conclusions has been obtained by the Organised Crime and Corruption Reporting Project. 

According to the document's in-depth findings, conclusions, and suggestions, Bitfinex failed to put the operational, financial, and technological controls recommended by its partner in cyber security, Bitgo, into place.

Although Bitfinex did not question the legitimacy of the report in contacts with journalists, OCCRP was unable to independently confirm the facts. Bitgo opted out of commenting but did not expressly deny the report's existence or its conclusions. Requests for response from Ledger Labs went unanswered, and the study's author, Michael Perklin, stated that he was unable to do so because his work on the iFinex report was subject to a non-disclosure agreement.

OCCRP was unable to independently verify the results, however in interactions with journalists, Bitfinex did not contest the validity of the study. Bitgo declined to comment, but did not expressly contest the report's validity or conclusions. An inquiry for response was not answered by Ledger Labs, and the study's author, Michael Perklin, declined to speak because his work on the iFinex research was subject to a non-disclosure agreement. 

For cryptocurrency sites, strict digital security is essential since mistakes cost users real money.

“When you’re dealing with the internet of money, the stakes are that much higher,” stated Hugh Brooks, director of security operations at blockchain security firm CertiK. “If you get breached or make a mistake, it’s not just some usernames and passwords, it’s someone’s life savings or potentially a massive amount of funds.”

According to the Ledger Labs report that OCCRP was able to receive, Bitfinex used a security mechanism that required an administrator to possess two out of the three security keys in order to do any substantial exchange activities, including moving bitcoin. 

However, it discovered that Bitfinex made a crucial mistake by putting two of these three keys on the same piece of hardware. An attacker who managed to hack that one device would have complete access to Bitfinex's internal systems and to "security tokens" that gave them control over the operating system. According to the paper, "the hacker was able to take two...security tokens," and in less than a minute, he was able to increase the daily cap on the number of transactions that were allowed in order to fast drain as much bitcoin as possible. 

According to the Ledger Labs report, the hacker obtained tokens associated with a generic "admin" email account and another tied to "giancarlo," which belonged to Bitfinex CFO and shareholder Giancarlo Devasini, a former Italian plastic surgeon with a shady business past. The document did not assign blame for the hack to Devasini.

The paper stated that holding numerous keys and tokens on a single device constituted "a violation of the CryptoCurrency Security Standard," alluding to an industry-led best-practice initiative, however it is unclear whether this particular device was compromised in the hack. It also claimed that other fundamental security precautions, such as monitoring server activities outside of the server, and a "withdrawal whitelist" - a security feature that only allows cryptocurrency transfers to confirmed or approved addresses — were missing.

Based on a rigorous study of source IP addresses, the Ledger Labs document found that the attack most likely started in Poland. 

Although the hacker is still at large, US authorities detained dual Russian-American citizen Ilya Lichtenstein and his wife, Heather Morgan, last year for allegedly laundering stolen bitcoins. Both have pled not guilty and await trial. 

Lichtenstein is a self-described digital entrepreneur and investor who has created a few tiny apps, while Morgan, a trained economist and Forbes.com contributor, has taken over as CEO of some of Lichtenstein's software initiatives. Morgan has an interesting backstory that includes a rapping alter ego known as "Razzlekhan." Nonetheless, US authorities highlighted in an official Department of Justice document that Morgan used her own name to cash out some of the stolen cryptocurrency's online purchases.
Read more »
Subscribe to: Posts (Atom)