TLDR
- Attackers stole $387.5 million from crypto exchange Bitget on Thursday, Sept. 24.
- NEAR Intents says its SHIELD system blocked more than $50 million in attempted transfers linked to the hack.
- The attacker used a zero-day flaw in a third-party security product to gain admin access, then deleted traces of the breach.
- Bitget’s user protection fund, worth $465 million, will cover the loss and get topped up to at least $300 million within a week.
- THORChain has refused to block addresses tied to the attacker, saying it does not selectively censor transactions.
Crypto exchange Bitget lost $387.5 million after an attacker broke into its systems on Thursday. The stolen funds moved across several blockchains in the hours that followed.
NEAR Intents, a protocol that lets users swap assets between different blockchains, says it stopped a portion of that money from being laundered. General manager Alex Shevchenko said the firm’s SHIELD system flagged and blocked more than $50 million in attempted transfers connected to the hack.
— Alex Shevchenko 🇺🇦 (@AlexAuroraDev) September 28, 2026
Shevchenko said the system froze $503,000 in funds while they were being moved. About $166,000 in suspected stolen funds still slipped through.
How the Bitget Hack Happened
Bitget CEO Gracy Chen laid out a timeline of the attack in an interview with The Block. She said the attacker ran two small test transfers at 6:31 p.m. UTC on Sept. 24.
Those transfers included 0.184 ETH and 193 TRX. Both amounts were small enough to stay under Bitget’s risk-control limits, so they did not trigger any alerts.
About 30 minutes later, the attacker moved much larger sums. Chen said 17 transactions across eight different networks, including Ethereum, XRP, Zcash, BNB Chain, Base, Arbitrum, Optimism, and Avalanche, added up to roughly $361 million.
Bitget caught the problem fast. Its reconciliation system spotted a mismatch just seven minutes after the first large transfer, and the exchange blocked all user withdrawals platform-wide.
By then, the attacker had already gotten into an internal management system. Chen said the intruder exploited a zero-day flaw in outside security software to obtain valid admin credentials.
That access let the attacker insert fake withdrawal commands into Bitget’s wallet backend, which treated them as real. The attacker then deleted the digital traces left behind, which Chen called the hardest part of the case to untangle.
Bitget has said its private keys and cold wallets were not touched. The company is working with security firms Mandiant and SlowMist and plans to release a full incident report this week.
Chen would not name the suspects but said Bitget believes it is the same group behind other recent thefts.
NEAR Intents and THORChain Take Different Paths
The hack has renewed a debate over how open crypto protocols should handle stolen funds. Bitget’s Chen asked THORChain, a decentralized asset-swapping protocol, to block wallets tied to the attacker.
THORChain Rejects Bitget’s Call to Block Attacker Funds After $387.5M Hack
THORChain responded to Bitget after CEO Gracy Chen called on the protocol to refuse service to addresses linked to attackers from Bitget’s September 24 security breach, which involved about $387.5 million… pic.twitter.com/hAhoCJKniv
— Wu Blockchain (@WuBlockchain) September 28, 2026
THORChain declined. The protocol said it does not selectively freeze funds, though it has paused its network before during emergencies.
NEAR Intents took the opposite stance. Shevchenko said his platform will actively work to stop stolen funds from moving through its system.
He also said NEAR Intents will skip the 5% bounty Bitget offered for freezing funds, plus another 5% for recovering them, so more money can go back to Bitget. Separately, Circle and Tether froze a wallet tied to the attacker on Friday, holding back $318,013 in USDT and USDC.
Bitget’s protection fund stood at $465 million as of Sept. 25 and will absorb the loss. Chen said corporate reserves of more than $1.4 billion will refill the fund to at least $300 million within a week.
Bitcoin withdrawals on Bitget resumed Monday, with more than 3,000 BTC processed in the first hour. Ethereum withdrawals reopen Sept. 29.
