Issue #013 · Week of September 27, 2026

This Week’s Verdict

The most expensive lesson this week cost Bitget $388 million, and the attacker never touched a private key. When your ledger trusts a forged internal transfer request, cold storage is theater. Everyone froze wallets after the money was gone, which is roughly the point of this newsletter.

The Breaches

Bitget is the headline, and it deserves the space. On September 24 at 18:31 UTC, attackers drained the exchange’s hot and warm wallets. The number started at $351.6 million, then crept to $387.5 million once Bitget finished counting assets on Zcash and TRON. CEO Gracy Chen confirmed the mechanism: not stolen keys, but spoofed internal transfer requests fed to a compromised backend. XRP and ether dominated the outflows. Cold wallets were untouched, which is the only sentence in the postmortem that reads like a win. Withdrawals remain paused.

The freeze effort tells the real story. Circle and Tether blacklisted a wallet tagged “Bitget Exploiter 8” and locked roughly $318,000 in USDC and USDT. Against $388 million, that is a rounding error, and it happened because the attacker had already swapped the bulk into unfreezable ETH. Ripple could not freeze the stolen XRP either, and the address then completed an XRP-to-bitcoin swap through THORChain despite a freeze demand from Bitget (more on that below).

Elsewhere, Duelbits co-founder reported a $7 million hack, with the casino offline and onchain records showing funds consolidated into ETH. Balances are reportedly untouched, pending reopening. The recurring theme: everything ends up in ETH, because ETH does not have a compliance desk.

Vulnerabilities Worth Your Attention

  • Magic Eden’s legacy approvals turned into a live exploit. A flaw in Limit Break’s Payment Processor V2, a contract Magic Eden stopped using in October 2024, let an attacker claim any approved NFT for 0 ETH. Nobody watched a dead contract for over 12 hours. Yuga Labs’ 0xQuit whitehatted 23,155 NFTs worth $5.7 million into protective custody. Holders still need to revoke approvals. Your old permissions never expire; your memory of granting them does.
  • KelpDAO’s $292M rsETH bridge exploit is now a lawsuit. KelpDAO developer Evercrest is suing LayerZero and CEO Bryan Pellegrino, alleging LayerZero endorsed the single-verifier configuration in writing, then warned a different developer against it. Pellegrino calls it meritless. Either way, “single verifier” and “$292 million” should never share a config file.
  • AlphaFi is winding down after an oracle error, with new deposits and loans disabled and Sui Foundation support arranged. Slush users are told to exit four strategies immediately. Oracle errors remain the quiet killer of DeFi yield products.
  • Cloudflare Containers cross-tenant flaw let a paying Workers customer recover residual disk data left behind by other tenants on the same host. Fixed, no live-workload access, but a reminder that “someone else’s leftover disk” is a category that should not exist.

Threat Actors & Campaigns

The Bitget fingerprints point at DPRK. Both Bitget’s CEO and The Hacker News name suspected North Korean actors, and the playbook fits: backend compromise, spoofed transfers, rapid consolidation into ETH, laundering through cross-chain swaps. Lazarus has spent years perfecting the exchange-drain-to-unfreezable-asset pipeline, and this is a textbook run.

On the traditional-crime side, ShinyHunters stayed busy, resuming mass exploitation of Oracle PeopleSoft (CVE-2026-35273, CVSS 9.8) via a URL-encoding WAF bypass, and separately defacing the Clop ransomware leak site through an unpatched Grav CMS path traversal. When extortion crews start hacking each other’s leak sites, the ecosystem is eating its own.

Also worth noting: PamStealer macOS malware added server-side payload decryption, and Lunex Stealer abused an AMD driver to disable security monitoring while targeting Ukrainian-speaking users through fake CAPTCHA lures. The credential-theft supply chain does not sleep.

The Bigger Picture

THORChain declined Bitget’s demand to block the hacker’s addresses, and the flagged address completed its swap anyway. OKX’s Star Xu challenged THORChain’s self-comparison to Bitcoin. This is the recurring philosophical fault line: a protocol that cannot censor is also a protocol that launders, and no amount of press-release outrage changes the code. It is the same lesson Ripple and the stablecoin issuers just relearned in real time.

On regulation, the Clarity Act collapsed in the Senate, and the response was telling. The SEC, CFTC, and Fed moved within days to write the rules themselves. SEC staff issued FAQs clarifying that token buybacks and network upgrades do not automatically make a token a security, and that qualifying liquid-staking receipts fall outside security categories. The Fed proposed capital charges and bank-approval rules for stablecoin issuers under the GENIUS Act, with a two-business-day redemption clock. Meanwhile Hester Peirce, the SEC’s steadiest crypto voice, departs October 2, and the Blockchain Association is swapping Summer Mersinger for interim CEO Kristin Smith. The advocates are leaving just as the rulemaking gets real.

Markets, briefly, because they are context. Spot Bitcoin ETFs turned 2026 flows positive with a $2.4 billion weekly haul, their largest since October, erasing a $5.8 billion hole. BTC consolidated near $84,000 while altcoins rallied and a $15.6 billion options expiry passed without drama. The tokenization grind continued: Aave V4 on Base added Coinbase stock tokens as collateral, and Ethena extended USDe backing into Binance bStocks and equity perpetuals. Wall Street and crypto are now fighting over the same turf, which means the attack surface is about to get a lot more interesting.

Resources

  • https://www.coindesk.com/markets/2026/09/25/bitget-s-usd351-million-hack-happened-via-spoofed-transfers-not-private-keys-ceo-gray-chen-says
  • https://decrypt.co/379350/bitget-hack-387m-what-happened-why-north-korea-suspect
  • https://thehackernews.com/2026/09/bitget-says-suspected-north-korean.html
  • Incident trackers (reference standard): Rekt leaderboard · SlowMist Hacked

More: Issues · Field Notes · RTFM

New Issue every week. Follow @ItsAlreadyPrice or subscribe via RSS so the next exploit does not surprise you.