Today’s Field Note

Chainalysis attributed the September 24 Bitget breach (roughly $387M) to North Korean actors, tracing laundering across four chains and pushing the DPRK’s 2026 haul past $1 billion. Bitget has rebuilt its protection fund to around $309M and resumed withdrawals for major assets, so the exchange is solvent, but the attribution tells you the usual actor is still fully operational and favoring exchange infrastructure over DeFi contracts. Separately, Near Intents recovered the roughly $3.8M drained Thursday after naming the attacker and issuing a 48-hour ultimatum. One worked because the attacker was reachable, the other because the attacker is a state. Do not confuse the two outcomes.

Today’s Move

  • If you hold on Bitget, confirm your specific assets are withdrawal-enabled before assuming full recovery, and move balances you do not actively trade to self-custody.
  • Builders using Near Intents: review the exploited path, confirm the patch is deployed, and treat the “voluntary return” as luck, not a control.
  • Audit hot wallet and operational signing keys on any exchange-adjacent infra now, since DPRK is targeting exchange internals, not just contracts.
  • Enforce non-SMS 2FA and hardware signing on all team accounts; social engineering of operators is the recurring Lazarus entry point.
  • Watch Chainalysis-flagged DPRK laundering addresses and block them at your deposit layer if you run a venue.

Resources

  • https://decrypt.co/380005/chainalysis-ai-87m-bitget-hack-north-korea
  • https://decrypt.co/380014/near-intents-recovers-3-8-million-after-48-hour-ultimatum
  • https://www.reddit.com/r/CryptoCurrency/comments/1wxgusp/bitget_rebuilds_300m_protection_fund_withdrawals/
  • Incident trackers (reference standard): Rekt leaderboard · SlowMist Hacked

More: Issues · Field Notes · RTFM

Daily field notes, weekly Issues. Follow @ItsAlreadyPrice or subscribe via RSS.