Incident record · Confirmed Bitget: Credential compromise Bitget resumed Bitcoin withdrawals after its $387.5M hack as CEO Gracy Chen revealed attackers stole internal credentials through a third-party flaw. The post Bitget reveals attack path behind $387.5M breach as Bitcoin withdrawals restart appeared first on Crypto Briefing .
Status Confirmed
Reported loss $387.5M
Chain Bitcoin
Confidence 80%
Evidence boundary Confidence describes the coverage of the available evidence. It is not a safety rating and does not guarantee that a protocol or asset is safe.
Sources Record history First seen: 2026-09-28T12:16:58.000Z. Last updated: 2026-10-03T09:18:26.627Z. Revision: 1.
Related incident records Bitget Hack Update: Security incident Chainalysis has attributed the $387 million Bitget theft to North Korean hackers. The firm said the attack lifts the value of crypto stolen by DPRK-linked actors this year above $1 billion. North Korean attackers reportedly used a cross-chain swap to convert stolen XRP into Bitcoin and kept the tokens away from exchanges. Drift, KelpDAO and The post Bitget Hack Update: XRP, Bitcoin, and North Korean Link appeared first on BeInCrypto .
NEAR Intents: Exploit TL;DR: The protocol recovered the entire $3.8 million drained well ahead of the deadline set for October 4, 2026. The return transaction on BNB Chain was confirmed at 16:15:28 UTC on October 2, 2026, featuring an input message from the attacker. The designated Bitcoin recovery address logged 34.59 BTC between 14:31 and 15:05 UTC, valued ... Read more
Bitget hack: Security incident BlockSec traced Bitget’s $387.5M theft into Bitcoin, THORChain and CoinJoin, while only about $840,000 has been publicly frozen.
El Salvador: Security incident IMF approved about $138M for El Salvador after waiving a Bitcoin accumulation breach and urged the government to reduce its crypto role.
Ex-NCA Officer Must Repay $2.4M for Bitcoin He: Security incident Paul Chowles took 50 BTC from a Silk Road 2.0 seizure in 2017. Prosecutors have now valued the theft at more than 30 times that.
Open the full incident tracker →