Bitget Hack Total Revised to $387.5 Million via Third-Party Security Vulnerability — THORChain Refuses to Block Hacker — Updates TTO-2026-0925-166

Summary

Bitget has revised the total value stolen in last week’s hack upward to $387.5 million, from the initial $351.6 million. Bitget CEO confirmed that the attack exploited a vulnerability in a third-party security provider rather than a flaw in Bitget’s own infrastructure. The DPRK-linked laundering operation has continued: the hacker is actively swapping stolen Ethereum through THORChain, a decentralized cross-chain liquidity protocol. THORChain has refused Bitget’s request to block the hacker’s transactions, citing its decentralized design. Bitget has resumed Bitcoin withdrawals.

Timeline

What Changed

Two material developments since TTO-2026-0926-171. The revised total of $387.5 million is $35.9 million higher than the initial figure, suggesting additional assets were identified as stolen during forensic investigation. Bitget CEO’s confirmation that the attack exploited a third-party security provider vulnerability is the first public statement attributing the attack vector — placing Bitget alongside a growing list of exchanges compromised through security infrastructure suppliers rather than their own applications.

Second, the laundering operation is using THORChain to convert stolen Ethereum across chains. THORChain is a decentralized cross-chain liquidity protocol that processes swaps without a central operator who can block individual transactions. When Bitget contacted THORChain requesting a block, THORChain declined, stating its decentralized design provides no mechanism for transaction censorship. Approximately $6 million in ETH was confirmed to have moved through THORChain, with additional swaps ongoing. The combination of XRP movements Ripple cannot freeze and ETH conversions through THORChain no one can block illustrates the laundering advantage of decentralized infrastructure over centralized stablecoins.

Domain Intelligence

bitget.com — 61.92

Score unchanged. bitget.com scores in the low-trust range at 61.92. Bitget is the hacked exchange.