Tag: crypto hack

  • OKX Founder Challenges THORChain’s Decentralization Claims After Bitget’s $387.5M Breach

    OKX Founder Challenges THORChain’s Decentralization Claims After Bitget’s $387.5M Breach

    OKX founder Star Xu has publicly questioned THORChain’s claim to true decentralization after funds linked to the Bitget security breach reportedly moved through the cross-chain network. The exchange now estimates the attacker made off with approximately $387.5 million and is asking industry partners to help block the stolen assets.

    Bitget Raises Loss Estimate to $387.5 Million

    On September 24, Bitget detected unauthorized transfers from certain hot wallets at 18:31 UTC. The exchange initially placed the damage at $351.6 million and paused withdrawals, while noting that cold wallets remained secure and its protection fund held more than $464 million.

    After further tracing, Bitget revised the amount sent to attacker-controlled addresses to $387.5 million. The update included Zcash and Tron transfers that were omitted from the initial figure; it did not reflect new transfers after the breach was contained. Mandiant and SlowMist are assisting with the investigation.

    Withdrawal restoration is scheduled in stages: Bitcoin on September 28, Ethereum on September 29, USDT on September 30, and other tokens, fiat withdrawals, and peer-to-peer services on October 2. Bitget stressed these dates are a restoration schedule, not confirmation that withdrawals have resumed.

    Star Xu Questions THORChain’s Validator Model

    Bitget CEO Gracy Chen asked THORChain to refuse transactions from addresses linked to the attacker. That request highlighted the network’s role in moving assets between blockchains and raised questions about whether its operators can act on publicly flagged wallets.

    In response, Xu argued THORChain should not be compared with Bitcoin or Ethereum. He said validators jointly control assets in vaults through a threshold-signing system. “I don’t think THORChain’s TSS + validator model represents true decentralization,” he wrote. “The selected validators set collectively controls the underlying assets in the TSS vaults. Once the signing threshold is reached, those validators can move the funds.”

    Under that model, a required group of validators can authorize transfers. Xu said this makes THORChain an intermediary, even though no single validator controls a vault.

    THORChain’s official account rejected that characterization, describing the network as decentralized and permissionless. It also questioned whether base-layer blockchains should face similar demands when stolen assets pass through them.

    Stablecoin Freezes and Recovery Efforts

    Circle and Tether froze roughly $318,000 in USDC and USDT at a wallet linked to the Bitget attack. The wallet held about 99,990 USDC and 218,023 USDT when the issuers blocked the tokens. Those issuer controls can stop stablecoin movement, but they do not give Circle or Tether control over Ethereum held at the same address.

    Bitget has also launched a recovery bounty program, offering eligible parties 5% of affected funds they help freeze or recover. The exchange published attacker addresses and a live tracing dashboard for firms monitoring the transfers.

    The confirmed freeze represents only a small portion of the $387.5 million estimate. Further recovery depends on where the assets move and whether the services handling them can restrict transfers. Bitget’s September 28 update is expected to provide more details on the investigation and withdrawal restoration.

  • Bybit Secures US Court Approval to Track Funds Stolen in $1.5B Lazarus Hack

    Bybit Secures US Court Approval to Track Funds Stolen in $1.5B Lazarus Hack

    In a significant legal victory, Bybit has obtained a U.S. federal court order allowing expedited discovery to trace assets linked to the $1.5 billion Lazarus Group hack. The ruling empowers the exchange to identify account holders, balances, and transaction histories from platforms operating in the United States.

    Court documents reveal that the order, issued in the District Court for the District of Columbia, permits Bybit to request detailed records before any changes occur. The lawsuit, filed under seal on June 18, targets North Korea’s Reconnaissance General Bureau, the Lazarus Group, and 20 unnamed defendants. The court approved expedited discovery the following day, while keeping certain exhibits sealed.

    To preserve identifiable assets, a temporary restraining order was issued on June 19, barring defendants from transferring specific funds. This order was renewed on July 16, and a partial preliminary injunction was granted on July 30. Bybit claims these legal steps are critical to freeze assets while the case proceeds.

    Despite these efforts, Bybit informed the court that 90.2% of the stolen assets had become untraceable by June 18. The funds were allegedly laundered through mixers, cross-chain bridges, and over-the-counter dealers, obscuring the transaction trail. Nonetheless, 9.8% of the total remains traceable, including $75.5 million that has either been frozen or returned to recovery channels.

    The February attack drained over 400,000 ETH and staked ETH from the Dubai-based exchange. Investigators linked the breach to compromised Safe Wallet infrastructure and developer credentials. The FBI officially attributed the theft to North Korea on February 26, 2025, under the operation name TraderTraitor.

    Bybit’s lawsuit seeks the return of stolen assets and $1.5 billion in compensatory damages, plus punitive and treble damages under the U.S. Racketeer Influenced and Corrupt Organizations Act. CEO Ben Zhou emphasized the company’s priority is to “protect our users first” and recover available funds, while holding those responsible accountable. Bybit plans to pursue further judicial relief and share blockchain records with investigators and regulators.

    North Korea has not publicly responded, and the defendants have yet to present a defense in unsealed filings. Parts of the proceedings remain confidential.