Bitget's $387.5 Million Theft Leads a Run of Hot-Wallet and Infrastructure Breaches That Bypassed Contract Audits

Rekt News has published post-mortems on a cluster of recent incidents. In most of them the failure point was infrastructure around the contracts, not contract code. The largest is Bitget. The exchange disclosed on September 24 that attackers took $387.5 million from its hot and warm wallets across 11 chains, including Ethereum, Tron, the XRP Ledger and Zcash. Separate investigations by SlowMist and Mandiant, the cyber-defense arm of Google Cloud, found that the attackers compromised two third-party security appliances with zero-day exploits. They used that access to obtain high-level internal credentials and to issue withdrawal commands that bypassed Bitget's risk controls. SlowMist dated the earliest malicious activity to August 31, more than three weeks before the theft. Circle, Tether and NEAR Intents froze about $1.1 million. Chainalysis attributed the theft to actors tied to North Korea, and Bitget cites IP behavior and on-chain analysis that point the same way. Pyongyang does not comment on such attributions.

On October 1, NEAR Intents lost $3.8 million and restricted deposits and withdrawals on 11 networks. The root cause was a bug in the interaction between the NEAR Intents contract and the custody architecture of Omni, its bridge, which allowed unauthorized withdrawals of USDT from a hot wallet on BNB Chain. Alex Shevchenko, NEAR Intents' general manager, publicly named the attacker and set a 48-hour deadline. The full $3.865 million came back within 24 hours.

The crypto casino Duelbits lost about $7 million when an attacker moved funds from its hot wallets on five chains in a suspected private-key compromise. The casino has since resumed operations. Nostra, a lending protocol on Starknet, lost $3.5 million to an oracle exploit. At SingularityNET, an attacker reached the project's cloud infrastructure and used it to mint tokens on its bridge without authorization and drain funds. BeInCrypto counts a 462% month-on-month jump in hack losses in September, driven by Bitget.