Security

TRON

GoPlus Security

THORChain

<h2 id="span-style-color-inherit-font-weight-bolder-span-style-font-size-16px-crypto-hack-news-today-how-did-attackers-bypass-bitget-s-security-span-span">Crypto Hack News Today: How Did Attackers Bypass Bitget's Security?</h2>
There's a lot of <a href="https://www.coingabbar.com/en/crypto-hack-news-today-meter-exploit-mtrg-crash-bitget-hack" style="font-size: 16px; background-color: rgb(255, 255, 255)" rel="noopener noreferrer nofollow">crypto hack news today</a> worth breaking down in detail, and most of it centers on new forensic findings from the Bitget breach.&nbsp;
Two separate security teams, <a href="https://www.coingabbar.com/en/crypto-currency-news/x402-protocol-hack-goplus-warns-of-176k-usdc-theft" rel="noopener noreferrer nofollow">GoPlus Security</a> and AMLBot, have published detailed technical analyses this week explaining exactly how attackers pulled off the $387.5 million theft and where the stolen funds actually sit right now.&nbsp;
The picture that emerges is more nuanced than a typical hack: this wasn't stolen private keys; it was a compromised trust chain.
<img alt="Information by WuBlockChain on X" src="https://d3iuzwoiyg9qa8.cloudfront.net/webadmin/storage/public/commonEditerImage/YVLKgzXm3VwaRS6A1jOxc4eYb76Cx8eKgSthIti6.png" width="300" title="Information by WuBlockChain on X">
Source: <a href="https://x.com/WuBlockchain/status/2103989833697992915" rel="noopener noreferrer nofollow">WuBlockChain on X</a>
<h3 id="span-span-style-font-size-16px-how-the-attack-actually-worked-span-span">How the Attack Actually Worked</h3>
According to<a href="https://x.com/GoPlusSecurity/status/2103780874659791082" rel="noopener noreferrer nofollow">GoPlus Security's detailed analysis</a>, the Bitget breach did not involve a private key leak at all.&nbsp;
<img alt="GoPlus Security detailed analysis" src="https://d3iuzwoiyg9qa8.cloudfront.net/webadmin/storage/public/commonEditerImage/i04ulc75JeN4XZKuPLqepaDPuPqPexPwnaEY3FBF.png" width="300" title="GoPlus Security detailed analysis">
Instead, attackers compromised a critical backend system within Bitget's wallet infrastructure, forged transaction data, and tricked <a href="https://www.coingabbar.com/en/what-happens-when-a-crypto-exchange-gets-hacked-explained-guide" rel="noopener noreferrer nofollow">the exchange's own authorized</a> signing flow into generating valid signatures for transfers Bitget never intended to make.&nbsp;
In GoPlus's own words, attackers "did not take the key layer. They took the risk-decision layer."&nbsp;
A normal withdrawal path runs through backend risk checks before a signer approves it, but attackers bypassed those checks entirely, feeding the signer already-poisoned transaction data it had no way to independently verify.
<h3 id="span-span-style-font-size-16px-the-timeline-of-the-drain-span-span">The Timeline of the Drain</h3>
GoPlus's timeline, cross-referenced with <a href="https://www.coingabbar.com/en/bitget-hack-update-total-loss-withdrawal-restart-september-2026" rel="noopener noreferrer nofollow">Bitget's own security updates</a>, lays out exactly how the attack unfolded:
<div>
 <table>
 <colgroup>
 <col width="103">
 <col width="498">
 </colgroup>
 <tbody>
 <tr>
 <td>Time (Sept 24)</td>
 <td>Event</td>
 </tr>
 <tr>
 <td>18:31 UTC</td>
 <td>The attacker received an address funded with 0.84 ETH gas; unauthorized transfers were detected</td>
 </tr>
 <tr>
 <td>18:58 UTC</td>
 <td>First large withdrawal: ~$34.75M USDT</td>
 </tr>
 <tr>
 <td>19:16 UTC</td>
 <td>Largest single wave: ~$185M drained in about one minute</td>
 </tr>
 <tr>
 <td>18:58–21:23 UTC</td>
 <td>Full 2-hour 25-minute multi-chain drain window across ETH, USDT, USDC, AVAX, BNB, XAUt, XRP, and TRX</td>
 </tr>
 <tr>
 <td>~21:30 UTC</td>
 <td>Bitget CEO Gracy Chen posts security notice, withdrawals paused.</td>
 </tr>
 </tbody>
 </table>
</div>
GoPlus flagged one particularly important detail: nearly three hours passed between detection at 18:31 and the last outgoing transfer at 21:23, with no circuit breaker halting the process.&nbsp;
Had the first $34.75M transfer tripped an automatic stop, GoPlus estimates roughly 90% of the stolen funds could have stayed in place.
<h3 id="span-span-style-font-size-16px-where-the-stolen-funds-actually-sit-right-now-span-span">Where the Stolen Funds Actually Sit Right Now</h3>
This is where things get genuinely interesting for anyone following crypto hack news today.&nbsp;
Per<a href="https://x.com/AMLBotHQ/status/2103510273378406550" rel="noopener noreferrer nofollow">AMLBot's tracing update</a>, roughly 88.1% of the stolen funds, about $343.2 million, is currently sitting completely dormant.&nbsp;
<img alt="AMLBot tracing update" src="https://d3iuzwoiyg9qa8.cloudfront.net/webadmin/storage/public/commonEditerImage/NG9PF03UiicyT11miQPNsUlRe8f3JQWzBhqKqh2p.png" width="300" title="AMLBot tracing update">
AMLBot identified 13 attacker wallets that have not sent a single transaction since being funded:
<ul>
 <li style="margin-left: 0px; list-style-type: disc">~68.3K ETH across 8 wallets on Ethereum Mainnet (~$184.79M)</li>
 <li style="margin-left: 0px; list-style-type: disc">~83.0M XRP across 4 wallets (~$128.56M)</li>
 <li style="margin-left: 0px; list-style-type: disc">~18.9K ZEC in a single wallet (~$29.88M)</li>
</ul>
The remaining roughly $46.2 million is actively moving, funneled mainly through one active <a href="https://www.coingabbar.com/en/best-xrp-wallets-2026" rel="noopener noreferrer nofollow">XRP wallet running</a> a "peel chain," where small amounts are repeatedly split off and laundered, with roughly 5.2 million XRP peeled off so far.&nbsp;
TRON, BNB, and stablecoin proceeds are being swapped into BTC using THORChain, Bridgers, and <a href="https://www.coingabbar.com/en/crypto-blogs-details/what-is-near-protocol" rel="noopener noreferrer nofollow">NEAR Intents</a>.
<h3 id="span-span-style-font-size-16px-the-mixer-connection-wasabi-coinjoin-span-span">The Mixer Connection: Wasabi CoinJoin</h3>
Adding another layer to this story,<a href="https://x.com/AMLBotHQ/status/2103895436557992242" rel="noopener noreferrer nofollow">AMLBot's separate tracing update</a> found that stolen funds have begun entering Wasabi CoinJoin, a Bitcoin mixing service.&nbsp;
<img alt="AMLBot tracing update on x" src="https://d3iuzwoiyg9qa8.cloudfront.net/webadmin/storage/public/commonEditerImage/TVj6rxfEXJlINxv4H6SkXVfYxsl0TZejk56047sH.png" width="300" title="AMLBot tracing update on x">
Roughly 4 BTC in one CoinJoin round was traced directly back to a Bitget TRON wallet.&nbsp;
The laundering path AMLBot mapped out was genuinely elaborate:
<ul>
 <li style="margin-left: 0px; list-style-type: disc">TRX converted to USDT</li>
 <li style="margin-left: 0px; list-style-type: disc">Bridged to Ethereum via USDT0</li>
 <li style="margin-left: 0px; list-style-type: disc">Swapped into roughly 145 ETH</li>
 <li style="margin-left: 0px; list-style-type: disc">Routed through THORChain into approximately 4.59 BTC</li>
 <li style="margin-left: 0px; list-style-type: disc">Split into smaller amounts and fed into CoinJoin rounds</li>
</ul>
AMLBot said it has blacklisted the related addresses and continues monitoring the attacker's <a href="https://www.coingabbar.com/en/bitcoin-defi-decentralized-finance" rel="noopener noreferrer nofollow">BTC holdings</a> for further CoinJoin activity.
<h3 id="span-span-style-font-size-16px-why-this-matters-beyond-bitget-span-span">Why This Matters Beyond Bitget</h3>
GoPlus drew a direct structural comparison to the 2025 Bybit hack, noting both incidents share the same underlying weakness: a single trust root feeding a single signing pipeline, whether compromised through a manipulated frontend interface (Bybit) or forged backend data (Bitget).&nbsp;
GoPlus's recommendations for exchanges going forward include standing up an independent pre-sign risk engine that scores every transaction before it's signed, implementing real circuit breakers with genuine rate limits, and treating staff and vendor supply-chain security as first-class controls rather than afterthoughts.
<h3 id="span-span-style-font-size-16px-conclusion-span-span">Conclusion</h3>
This round of crypto hack news today paints a clearer, more technical picture of exactly how $387.5 million left Bitget's wallets in just over two hours and where most of it has ended up since.&nbsp;
With 88% of stolen funds still sitting dormant across traced wallets, active laundering now confirmed through Wasabi CoinJoin, and structural parallels drawn to the 2025 Bybit breach: this incident is shaping up to be a genuine case study in signing-pipeline security, one that both GoPlus and AMLBot are continuing to actively monitor as the situation develops.
<h3 id="span-span-style-font-size-16px-disclaimer-span-span">Disclaimer</h3>
This article is for educational and informational purposes only and should not be considered financial or investment advice. Always conduct your own research before making investment decisions.

Crypto Hack News Today: Bitget Attackers Bypassed Its Signing Controls

Table of Contents

Coingabbar

Other articles published on Sep 27, 2026

Why Is Quant (QNT) Price Surging Today?

Bitget Hack Funds: 4 BTC Traced Through Wasabi CoinJoin Mixing Tool

Google's Gemini test lets Indian shoppers buy from Flipkart but not Amazon

Zcash Memo Field Explained: Private Messaging in Transactions

Crypto Michael predicts XRP will break all resistance levels with rapid move

BlockDAG Global Launch Date? BDAG Price Reclaims, Can It Rise to $0.5?

Join our free newsletter for daily crypto updates!