369 Guard

Update · 2026-10-07

Certora: most of the loss left after Bitget's own alarm

07 Oct Grok window: Certora says reconciliation flagged the gap at 19:05 UTC and Bitget blocked withdrawals, but forged requests were not user withdrawals, so the signer kept signing.

8M warm-wallet burst left at 19:16 UTC; signing services shut at 21:44 UTC. Every stolen transfer carried a valid Bitget signature. 1M. Formal technical report and vendor names still unpublished.

Certora invariant: every signed transfer must bind to one approved withdrawal record from a process the requester cannot write.

Update · 2026-10-06

ZachXBT sting on a Chinese OTC desk moving Lazarus funds

7k USDC after Bybit. Public Telegram and Discord order desks, THORChain hops, and Tron USDT acceptors are the human layer behind rails already on this card.

Tether froze about 442k USDT on a matched Bybit cluster in that sting. He says the same public order-request pattern showed up again after the Bitget theft. 1M.

Update · 2026-10-02

DAI to Tron laundering; Wasabi CoinJoin; tiny freezes

02 Oct Grok window: MistTrack flags continued DAI to USDT to USDT0 to Tron laundering of existing proceeds (not a new theft). AMLBot path notes roughly 4 BTC into Wasabi CoinJoin.

1M has been frozen (not necessarily returned) and she is not expecting to recover a lot. Protection Fund restored above $300M from Bitget’s own capital.

Remaining-token withdrawal timetable for 02 Oct is ops follow-through only. Product A/B vendors still unnamed.

Update · 2026-09-30

SlowMist: foothold from ~31 Aug; CoW into Chainflip toward BTC

30 Sep Grok window: SlowMist/Mandiant forensics put earliest malicious activity on a compromised third-party security product node around 31 Aug (~25 days before the drain).

Invariant holds: vendor zero-day to admin creds to sub-threshold tests to spoofed withdrawal commands Bitget’s signing path treated as legit; cold keys not taken.

MistTrack also flags automated CoW Protocol orders whose recipients are pre-prepared Chainflip deposit contracts, then BTC.

That is a new laundering rail beyond the earlier NEAR Intents SHIELD freeze and THORChain refuse. USDT withdrawal phase remains timetable follow-through only.

Update · 2026-09-29

NEAR Intents blocks ~$50M+; CEO cites third-party zero-day

29 Sep Grok window: NEAR Intents SHIELD said it blocked more than $50M in Bitget-linked laundering attempts (~$503k frozen mid-flow; ~$166k slipped). Protocol waived Bitget’s recovery bounty share.

CEO told The Block the path used a zero-day in a third-party security product for admin credentials, then small test transfers before large drains. Formal incident report still expected.

ETH-family withdrawals were on the prior 29 Sep schedule.

Update · 2026-09-28

Four-phase withdrawals start; THORChain refuse deny-list

28 Sep Grok window: Bitget posted a four-phase withdrawal return (BTC 28 Sep, ETH 29 Sep, USDT 30 Sep, remaining tokens/fiat/P2P 2 Oct, all 08:00 UTC).

User Protection Fund and RecoveryBounty (5% of frozen/recovered) remain their claims. Separately, Bitget asked THORChain to deny linked addresses; THORChain declined as permissionless.

DPRK attribution still unconfirmed.

Update · 2026-09-26

Official revise to ~$387.5M; Mandiant and SlowMist; bounty live

5M (adds Zcash/TRON accounting, not a second drain).

Bitget claims the vulnerability is remediated, investigation continues with Mandiant and SlowMist, and published a recovery bounty plus live tracing dashboard. Title and summary refreshed to match.