Security systems at Seychelles-based Bitget detected unauthorized transfers from hot wallets on September 24, 2026, and the exchange says investigators found no private-key compromise. Instead, attackers exploited a critical backend wallet system to spoof transaction data and trigger internal authorizations, draining hot and warm wallet layers while leaving cold storage and Bitget Wallet users untouched. Initial loss estimates of $351.6 million were later revised to about $387.5 million after Bitget added omitted token balances; on-chain trackers list the largest pieces as 102.93 million XRP (~$157.5M) and 31,890 ETH (~$85.8M), plus large USDT/USDC and other token holdings. Bitget engaged Mandiant and SlowMist, paused withdrawals while keeping deposits and trading open, and said the entire shortfall sits inside a User Protection Fund the firm values at roughly 5,500 BTC (> $460M). The exchange launched a recovery bounty offering 5% for voluntarily freezing or returning funds and provided tracing and reporting channels.
Bitget’s CEO and blockchain analytics firms including Elliptic link the theft to North Korean state‑linked actors, citing VPN/IP patterns and on‑chain ties between these proceeds and addresses used in prior DPRK‑attributed heists such as Bybit and other large thefts this year; analysts call this the largest suspected North Korean crypto theft of 2026. The incident fits a broader trend of escalating crypto breaches - social‑engineering and protocol bugs have already produced hundreds of millions in losses this year - and highlights continued challenges in custody infrastructure, on‑chain laundering, and cross‑issuer measures (Circle/Tether blacklisted a small related address) amid denials from Pyongyang.
Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.
YouTube, TikTok, and Meta have all rejected paid ads for a documentary about Elon Musk, citing political content concerns. X has also refused to take calls from the distributor, Bleecker Street, which is now appealing the decision. (hollywoodreporter.com)
A New Mexico jury found Facebook liable for deceiving users about privacy protections related to the Cambridge Analytica data breach. The verdict holds Facebook accountable for misrepresenting its data practices and impacting over 2 million residents of the state. (cbsnews.com)
Melamine cleaning sponges release over a trillion microplastic fibers globally each month as they break down during use. These tiny fibers can enter water systems, contributing significantly to environmental microplastic pollution. (sciencedaily.com)
Malicious Twitch chat messages can exploit vulnerabilities in OBS Studio, leading to remote code execution. This security flaw allows attackers to potentially take control of the broadcasting software through crafted messages. (cyberinsider.com)
Lindsey Isaacs was falsely arrested and held for 13 days based on a single Flock camera license plate reading. The police mistakenly linked her to a deadly accident, ignoring evidence that her car was the wrong color and undamaged. (jezebel.com)
OpenAI's systems reportedly malfunctioned and interfered with U.S. government websites. The incident raises concerns about AI system safety and security. (nytimes.com)
Today's best Hacker News stories, summarized and screenshotted, one email a day.