ole

Slow Fog issued a security alert stating that the Aave V3 Loop Safe Module has a security vulnerability, allowing attackers to forge Safe authentication and execute arbitrary modules, stealing approximately 114.09 ETH from two Safe multi-signature wallets.Attackers bypassed authentication by forging a Safe that always returns true and executed module transactions using a router and calldata that could be arbitrarily controlled, transferring weETH and Aave collateral. After repaying approximately 1300 WETH in debt, the attackers unlocked the collateral.

According to Cointelegraph, NEAR Intents General Manager Alex Shevchenko stated that the team has confirmed the identity of the hacker behind the previous security incident and has given them a 48-hour deadline to return the stolen funds through "responsible disclosure."NEAR Intents previously suspended services due to a vulnerability in the interaction between the Omni deposit and withdrawal infrastructure and NEAR Intents smart contracts. Preliminary investigations indicate that approximately $3.8 million in user funds were stolen in this incident, and the team has committed to fully compensating affected users.On-chain detective ZachXBT stated that the stolen funds were subsequently transferred to KuCoin and converted to Bitcoin across chains.

Coinbase released a report indicating that the profit-taking scale of BTC has risen to its highest level of the year, while market demand has cooled. On September 22, holders realized a profit of 25,700 BTC in a single day, the highest daily level since 2026. At the same time, the unrealized profit margin for short-term traders rose to 33%, the highest since December 2024.Meanwhile, in the past 30 days, the apparent spot demand for BTC has decreased by 170,000 coins; the incremental speculative futures demand also dropped from 164,000 coins on September 14 to 16,000 coins on September 29.

The Drift Foundation announced the progress of recovering funds from the security incident on April 1, where approximately $295.4 million in user assets were stolen. The foundation has hired Mandiant, zeroShadow, and SEAL 911 to conduct investigations and fund tracking, with Mandiant identifying the attackers as the North Korean threat organization UNC6862.The stolen funds were subsequently bridged to Ethereum, with approximately 130,259 ETH dispersed across four wallets. Of these, three wallets have not transferred any funds to date, holding a total of 107,165 ETH; the other wallet transferred about 23,094 ETH to Tornado Cash on July 23. The foundation stated that approximately $9.2 million of the stolen funds have been frozen, with the relevant funds previously transferred through Tornado Cash in August, but unfreezing and returning still require legal procedures.The Drift Foundation will transfer all assets recovered through freezing, bounties, or law enforcement to the DFX recovery pool and is assessing the subsequent path of the DRIFT token within the broader ecosystem. Additionally, the foundation has partnered with Bybit to launch a public bounty program, offering a 10% bounty for successfully recovered funds.

CoinBureau cites on-chain investigator ZachXBT, stating that suspected North Korean attackers are using Zcash to obscure the stolen funds from Bitget. Approximately 2,700 ZEC, worth about 3.8 million dollars, have begun to be transferred to Zcash's Ironwood.These stolen ZEC are being moved into a shielding pool, where transaction details can be hidden. In a security incident involving various assets totaling about 388 million dollars, approximately 18,900 ZEC, worth about 28.3 million dollars, were stolen. Previously, Bitget's CEO Gracy Chen expressed that she is "not very optimistic" about recovering the stolen funds.

The U.S. Department of Energy announced it will release up to 40 million barrels of oil from the Strategic Petroleum Reserve.

Cross-chain trading protocol NEAR Intents stated in a post on X that on September 24, Bitget was attacked, resulting in approximately $387.5 million in funds being stolen, most of which were aggregated into Ethereum and converted to ETH. The hacker attempted to transfer over $50 million through NEAR Intents, but ultimately only $166,000 was successfully transferred, while $503,000 was intercepted during the execution process.NEAR Intents indicated that the relevant data comes from on-chain tracking tools, Arkham, internal logs, and risk control layer SHIELD, among other sources. The figures listed are rounded estimates, with an assessment deviation of no more than 10%. SHIELD identified over $50 million in money laundering attempts and has filtered out duplicate flows, of which $166,000 has been successfully transferred, while another $503,000 was frozen midway through execution and remains restricted, pending legal and recovery procedures.NEAR Intents stated: permissionless does not equal neutral, the team refuses to assist in cashing out stolen assets and will forgo the bounty from this incident to allow Bitget to recover funds as much as possible. Bitget previously established a 5% + 5% bounty arrangement. NEAR Intents also mentioned that the protocol will remain permissionless but set boundaries, and will combat money laundering of stolen funds, while suggesting Bitget contact legal and law enforcement channels to handle the frozen funds.

According to on-chain analyst Yu Jin's monitoring, over 90% of the funds exchanged across chains through THORChain are from illicit sources. Yu Jin stated that most of the stolen funds from Bybit last year were transferred via THORChain, which collected nearly 10 million dollars in fees within 10 days; recently, part of the stolen funds from Bitget has also been transferred through THORChain, with its fee income reaching 1 million dollars.

Cryptocurrency analyst Darkfost stated on the X platform that based on the inflow of BTC from long-term holders (LTH) to exchanges, during the market peak in March 2024, LTH were most active in the bull market phase, with daily inflows to exchanges exceeding the annual average by more than five times.In contrast, LTH were relatively calm during the peak in 2025, and as the bear market began, their activity significantly increased, with the annual average daily inflow of BTC rising from about 600 to around 1000. As the market approached the bear market bottom, the inflow on certain trading days far exceeded the annual average, which aligns with the situation where previous high-level buyers realized increased losses.Darkfost noted that currently, LTH-related activities are gradually cooling down, with inflows to exchanges still significantly below the annual average, indicating a change in their behavior, and the market is becoming more rational.

Bitget CEO Gracy Chen stated on the X platform that the Bitget bounty recovery program has been launched: a 5% reward for facilitating the freezing of the attackers' funds, and an additional 5% reward for successfully recovering the funds. She called on exchanges, security researchers, and on-chain investigators to participate in tracking and recovery, and thanked Circle and Tether for their swift freezing actions.According to previous reports, Circle and Tether have frozen 218,023 USDT and 99,990 USDC in addresses related to the Bitget attack, totaling approximately $318,000. Bitget stated that the attack resulted in losses of about $351.6 million, with the attackers breaching the wallet service backend system, forging transfer information, and triggering the authorization signature process, ruling out private key leakage.

According to Catcher Predict monitoring, in the Polymarket event "Baltimore Orioles vs. New York Yankees," the "Baltimore Orioles" option in the sub-market "Baltimore Orioles vs. New York Yankees" has experienced significant fluctuations in winning probability, soaring from 47.5% an hour ago to the current 91.5% (a fluctuation of 44%). Please note the impact of relevant breaking news.

Bitget TradFi Chief Growth Officer Xie Jiayin issued an update on the platform's security incident, stating that the withdrawal time will be announced before noon tomorrow. The security team has identified the hacker's attack path and methods, and has grasped the details of how the attacker bypassed security measures, coming very close to tracing the source of the attack. The incident investigation by third-party security teams Mandiant and SlowMist is still ongoing, with a detailed report pending from the security team.On-chain tracking confirms that approximately $387.5 million has been transferred to the hacker's address, previously estimated at $351.6 million. This revision includes ZEC and TRX, and no other unauthorized transfers have been found. Xie Jiayin stated that the stolen funds at the platform level will be fully covered by the Bitget User Protection Fund, ensuring that user assets are not subject to any losses.Bitget has officially launched a fund recovery bounty program, offering a 5% bounty for voluntarily freezing the attacker’s funds and a 5% bounty for voluntarily recovering funds. The bounty also applies to assistance already provided. The platform has published the attacker's address, a real-time tracking dashboard, and a submission portal, with relevant information also available for submission through Bybit's Lazarus bounty platform.

According to on-chain data, Tether has successfully frozen 218,000 USDT in the stolen address from Bitget, which is a "three-hop" associated address of the initial stolen address from Bitget. This address remained inactive for over 2.5 hours after being discovered.Crypto KOL tanuki42 initiated a tracking of "Circle vs Tether" at that time and asked which of the two companies would freeze the related assets first.Currently, Circle has frozen the related stolen assets 7 hours and 18 minutes earlier than Tether.

According to on-chain analyst tanuki42, the address 0xe07 holds 100,000 USDC and 218,000 USDT, which come from the initial address of stolen funds from Bitget. This batch of funds has been idle for over 2.5 hours, after which they publicly called on Circle and Tether to freeze the assets.At 5 PM, crypto researcher SomaXBT posted that Circle has frozen the USDC assets and specifically called on Tether to follow up. As of the time of publication, Tether has not responded.

Binance Co-CEO Richard Teng stated that since the discovery of the security incident at Bitget, the Binance security team has been closely collaborating with Bitget to assist in sharing security intelligence, tracking related funds, and supporting asset recovery efforts.Richard Teng mentioned that in such security incidents, the cryptocurrency industry will unite to respond to attackers, and the relevant assistance work is still ongoing.

According to monitoring by Blockaid, Limit Break on Ethereum is currently facing ongoing attacks. The attackers are using Limit Break Payment Processor V2 to impersonate NFT holders and purchase authorized NFTs at a zero price. Currently, about 3 transactions have resulted in approximately 1.7 million dollars worth of NFTs being stolen.Blockaid reminds users who have authorized Payment Processor V2 as an NFT Operator to immediately revoke the relevant authorization. Simply canceling orders or Master Nonce will not lift this permission.

According to on-chain detective Specter, by tracking on-chain fund flows, the North Korean hacker organization Lazarus Group may be the behind-the-scenes attacker of the Bitget theft incident. This incident is linked to the AFX attack that occurred in July this year, which resulted in losses of approximately 24 million dollars and was attributed to TraderTraitor associated with Lazarus Group.The stolen XRP from Bitget, after cross-chain transfer, can be directly linked to the stolen funds in the AFX attack.

According to monitoring by Lookonchain, Bitget was attacked this time with stolen assets valued at approximately 356.86 million USD. Among them, 102,926,478 XRP (157.48 million USD) and 31,890 ETH (8.575 million USD) are the main parts of the stolen assets.The remaining stolen assets include 34,751,168 USDT (34.75 million USD), 21,056,725 USDC (21.06 million USD), 19,668,852 USD₮0 (19.67 million USD), 3,000 XAUt (12.82 million USD), 12,719 BNB (9.88 million USD), 821,012 AVAX (8.38 million USD), and 20,593,377 TRX (7.07 million USD).

Bitget CEO Gracy Chen stated during a live broadcast regarding the platform's attack incident that some of the affected funds may have a chance of being recovered. Regarding the resumption of withdrawals, Gracy Chen mentioned that Bitget needs to first investigate the relevant issues thoroughly. The technical team is currently advancing system repairs and security enhancements. The platform will only reopen the withdrawal function after confirming the system's security and ensuring that resuming withdrawals will not lead to further attacks by hackers.She stated that once a clear time window for the resumption of withdrawals is established, users will be informed immediately and an announcement will be made. Currently, no specific time can be promised, as the platform does not wish to make commitments that cannot be fulfilled.

According to on-chain analyst Yu Jin's monitoring, Bitget's stolen assets this time amount to approximately 351.6 million USD, of which about 192.6 million USD was stolen from the EVM chain, mainly including stablecoins and ETH.In the past few hours, hackers have gradually exchanged the stolen stablecoins and other assets on the EVM chain for ETH. Currently, the relevant hacker EVM address holds approximately 68,500 ETH, worth about 184 million USD.