Security

NEAR Intents, a crosschain swap protocol built on NEAR, suffered a security exploit on Thursday that resulted in losses of about $3.8 million. The service has been paused. A week earlier, the protocol publicly blocked up to $50 million in stolen funds linked to the Bitget attackers. The team said it has patched the flaw and will fully reimburse users.

Bitget said BTC withdrawals are now live on the Bitcoin mainnet and BSC, with 9,585 orders and 4,098.036 BTC processed as of 17:00 UTC+8. The exchange said ETH, USDT and other assets will reopen in phases starting tomorrow. Bitget said the incident stemmed from vulnerabilities in third-party products that enabled an attacker to obtain internal credentials and submit fraudulent withdrawal commands that bypassed risk controls, while private keys and cold wallets were not affected. The platform said user funds are fully covered by the Bitget Protection Fund and it will replenish the fund to >$300M with its own capital within the week.

Payy’s bridging protocol was hit by a security exploit that has frozen its crypto card services, putting users’ account balances at risk. The attacker allegedly used a vulnerability in the bridge contract to move assets illegally, including stablecoins such as USDC. Affected users are unable to make payments or withdraw funds. The incident underscores serious weaknesses in Payy’s asset custody and cross-chain bridge security, directly disrupting crypto payment apps that rely on its services.

Bitget CEO Gracy Chen said the exchange’s $351M security incident affected several major blockchain networks, including Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC and Base. Tokens impacted include ETH, XRP, BNB, AVAX, USDT and USDC. Bitget said its on-chain cold wallets were not breached and that Bitget Wallet operates independently and was not affected. The exchange has contacted each affected chain’s foundation, with some confirming freezes on suspected hacker addresses, according to Chen.

Bitget’s CEO said in a livestream that the exchange suffered a security incident in which assets were stolen from hot wallets, involving ETH, XRP, BNB, AVAX, USDT and USDC across seven blockchains including Ethereum and the XRP Ledger. XRP was described as the largest single-chain loss. On-chain analysis indicates the attack method matches techniques used by DPRK-linked hacker groups, the CEO said.

An exchange said a vulnerability in a third-party back-end tool allowed forged instructions to bypass its wallet approval process, resulting in the theft of about 103 million XRP and 31,890 ETH worth about $357 million. The estimate was slightly revised up from a previous $351.6 million. It has suspended withdrawals because it is not yet certain the flaw has been fully patched and fears resuming withdrawals prematurely could lead to another theft. The attacker IP characteristics match VPN patterns commonly used by known North Korea-linked hacking groups, the exchange said.

Between Sept 15–20, about 11.7M XRP (~$20M) was stolen from D’CENT App Wallet users, affecting 6,678 wallets. The attacker used keys already under their control to execute valid-signature transactions in six coordinated waves, with 5,001 accounts deleted to claim reserve balances. About 5.6M XRP was routed to Ethereum via THORChain, while the rest moved through Binance and NEAR Intents and was often off-ramped within hours. As of Sept 21, attacker wallets still held about 1.3M XRP; D’CENT said its hardware wallets were not impacted and has not announced reimbursement.

Liquid Network was hit by a hack in which nearly all of its Bitcoin was stolen, but the attackers returned most of the funds after a vulnerability patch was issued. The network has paused new transactions while fixes are implemented. The incident highlights security risks around Bitcoin sidechains, with limited realized asset losses but renewed concerns about the technology’s reliability. There is still no confirmed timeline for the network to fully resume normal operations.

A total of 4,000 bitcoin (BTC) was unexpectedly pegged out of the Liquid sidechain bridge, with the transfer carrying an OP_RETURN note claiming the operator was a “whitehat” and requesting on-chain contact. The messaging and behavior were compared to the Ronin Network incident in which validator keys were compromised and about $625M was stolen. They were also likened to the “let’s talk” approach used by the Euler attacker to negotiate a return after the fact. The destination of the funds and the operator’s true intent remain unclear.

GoMining has suffered a security incident in which a hack emptied more than 600 wallets, with total losses of about $2.8 million in crypto assets. The attackers then swapped the stolen funds into ETH and consolidated the holdings. The incident directly threatens the safety of funds held by GOMINING token holders and highlights serious weaknesses in the project’s wallet security. The token’s price could face negative pressure, while the large-scale conversion into ETH may add additional selling pressure to the Ethereum market.