hot wallet

Duelbits

2026-10-08 10:48:46

Duelbits offers on-chain bounty settlement over stolen funds

Duelbits has posted an on-chain settlement proposal tied to its stolen funds case, according to monitoring by Defimon Alerts. The message said the platform had traced the movement of the stolen assets and identified suspected parties along with related wallets, exchanges, and accounts. Under the proposal, the counterparty would be allowed to keep an agreed portion of the funds and return the rest. The message added that if a formal agreement is signed and repayment is completed, Duelbits would not pursue criminal charges or take further legal action. Foresight News had previously reported that on Sept. 24, Duelbits lost about $7 million after a private key leak compromised its hot wallet. The latest development points to a negotiated recovery route rather than an immediate escalation, though the terms referenced in the on-chain message were not disclosed in detail.

290

79AU

2026-10-08 07:49:08

79th Vault hot wallet on BNB Chain may have lost about $12.5 million in suspected private key leak

Defimon Alerts said 79th Vault on BNB Chain may have suffered a loss of about $12.5 million after what appears to be a private key compromise involving its operational hot wallet. The monitoring account said the wallet was typically used only for small transfers into the reward pool, but it recently moved 2.01 million 79AU out of the trading pair to an external address in seven transactions. Those transfers were listed as 10,000, 100,000, 100,000, 300,000, 500,000, 500,000 and 500,000 79AU. The attacker then swapped the tokens back into the same trading pair through about 95 transactions. As that happened, the pool’s USDT reserves fell from $15.2 million to $3.9 million. Defimon Alerts said the attacker cashed out 16,249 BNB, worth about $12.5 million by its estimate. The monitoring update also said the operational key sent another 3.79 BNB to the same external address. Separately, another 500,000 79AU was transferred to other addresses. The information was cited from a post by Defimon Alerts.

320

79thVault

2026-10-08 07:51:56

79thVault hot wallet on BNB Chain reportedly drained for about $12.5 million in suspected private key leak

A hot wallet operated by 79thVault on BNB Chain appears to have been compromised in what Odaily described as a suspected private key leak, with losses estimated at roughly $12.5 million. According to the report, the team normally used the wallet only for small transfers into a rewards pool, making the recent activity stand out from its usual pattern. On-chain movements cited in the report show the address sending a total of 2.01 million 79AU from the trading pair to an external address in seven transactions. The individual transfers were 10,000, 100,000, 100,000, 300,000, 500,000, 500,000 and 500,000 tokens. The attacker then sold the 79AU back into the same trading pair through around 95 swap transactions. That activity reduced the pool’s USDT reserves from $15.2 million to $3.9 million and cashed out 16,249 BNB, worth about $12.5 million. Odaily also said the operating key later sent another 3.79 BNB to the same external address, while an additional 500,000 79AU was transferred to other addresses.

330

NEAR Intents

2026-10-01 13:08:42

NEAR Intents confirms exploit, with losses topping $3.8 million

NEAR Intents said it was hit by an attack and traced the issue to a flaw in how its Omni deposit and withdrawal infrastructure interacted with smart contracts. The project said the contract vulnerability has already been fixed and that core services are expected to resume within one hour. It also said affected users will be fully reimbursed for damaged assets. At the same time, deposit and withdrawal services on several chains, including BSC, Polygon and TON, will remain suspended for about 12 more hours. NEAR Intents said the case has been reported and on-chain tracking is under way. Separately, on-chain investigator ZachXBT said NEAR Intents’ BSC hot wallet showed multiple abnormal outflows. According to his statement, the stolen funds were moved to KuCoin and then bridged onward to the Bitcoin network. The amount involved now exceeds $3.8 million.

470

Bitget

2026-09-30 10:24:47

Bitget attacker starts moving about 2,700 ZEC into Zcash Ironwood shielded pool

On Sept. 30, on-chain investigator ZachXBT said an attacker tied to the Bitget theft and suspected of links to North Korea has started moving about 2,700 ZEC into Zcash’s Ironwood shielded pool. The amount was valued at roughly $3.8 million based on the figures cited in the report. ZachXBT’s update points to a new movement of funds from the Bitget incident rather than a newly disclosed theft amount. Earlier, about 18,900 ZEC were stolen from a Bitget hot wallet, with the total value put at around $28.3 million. The transfer into a shielded pool is notable because it involves privacy-focused infrastructure within the Zcash network. The report attributes the information directly to ZachXBT and does not provide further transaction details beyond the amount moved and the earlier total stolen from Bitget.

620

Bitget

2026-09-30 05:09:00

SlowMist says Bitget theft traces back to Aug. 31 and involved a third-party zero-day flaw

Blockchain security firm SlowMist said in a preliminary investigation that the Bitget hot wallet theft disclosed on Sept. 25 can be traced back to malicious activity as early as Aug. 31. The probe, conducted at Bitget’s request, found signs of attacks involving a specific third-party security product, the host running a wallet application, and a highly customized withdrawal tool used by the attacker. According to the report, an unauthorized party accessed the management platform of the third-party product on Sept. 25 while posing as an internal employee. SlowMist also said it identified and obtained a custom withdrawal tool designed to interact with the wallet system’s withdrawal logic. On-chain activity began at 02:31 on Sept. 25 and involved transfers across multiple blockchains over roughly 2 hours and 52 minutes. The report added that the attacker later attempted to tamper with withdrawal records and trigger additional BTC withdrawals. The findings released so far are described as preliminary as of Sept. 29.

420

SlowMist

2026-09-30 04:23:06

SlowMist says Bitget hot wallet theft probe points to third-party security product flaw

SlowMist said on Sept. 30 that Bitget had asked its security team to investigate the hot wallet asset theft that took place on Sept. 25. As of Sept. 29, the firm said its investigation had found that the attack involved a third-party security product, malicious activity on the wallet application host, and a custom withdrawal tool developed by the attacker. According to SlowMist, the attacker used a zero-day vulnerability in a third-party product to carry out malicious actions, then used an internal employee identity on Sept. 25 to gain unauthorized access to the management platform of that third-party product. The attacker also obtained and used a customized tool designed around the wallet’s withdrawal logic. SlowMist said on-chain activity began at 02:31 on Sept. 25 (UTC+8), and assets were moved across multiple blockchains over roughly 2 hours and 52 minutes. It added that the attacker later attempted to tamper with withdrawal records and triggered additional BTC withdrawals. The firm said it is still investigating how the attacker moved laterally between affected systems.

460

Bitget

2026-09-29 01:12:24

Bitget says $388 million theft stemmed from zero-day flaw in third-party security product

Bitget said a recent $388 million security breach was caused by a zero-day vulnerability in a third-party security product, which attackers used to steal high-privilege internal credentials, enter a critical management system, forge withdrawal instructions and bypass risk controls. In a public livestream, CEO Gracy Chen and Greater China head Xie Jiayin said the incident hit hot wallet and warm wallet infrastructure, while private keys and cold wallets were not affected. The exchange said user balances remain intact and losses will be covered in full by Bitget’s user protection fund. According to Bitget’s reconstruction, the attack began with two small test transfers before moving into large withdrawals across Ethereum, XRP, ZEC, BSC, Base, Arbitrum, Optimism and Avalanche. The company said it later isolated affected systems, reset internal credentials, tightened high-sensitivity permissions and added independent verification for all withdrawals. It also said Mandiant and SlowMist are assisting with forensics and on-chain tracing, while a bounty program has been launched to support asset recovery. Bitget said it will not rely on recovered funds as the main safeguard for users. After using the protection fund to absorb losses, the company plans to replenish it to at least $300 million within one week. A separate independent security report is expected within a week, according to the company.

540