GoPlus Challenges THORChain’s Decentralization Claims Over DPRK-Linked Fund Flows GoPlus Security argued that THORChain should not compare itself directly with Bitcoin or Ethereum when defending its inability to block illicit flows. It said THORChain outbounds rely on threshold signatures from a relatively small active validator set, while the protocol already includes pause, per-chain signing halt and governance mechanisms. GoPlus pointed to prior intervention during THORChain’s own exploit and argued that FBI- or OFAC-attributed DPRK-linked funds could be blocked under the protocol’s existing emergency framework.

AMLBot Traces About 4 BTC From Bitget Hack Into Wasabi CoinJoin Crypto compliance and blockchain analytics platform AMLBot said some funds linked to the Bitget theft appear to have entered Wasabi CoinJoin. Its tracing linked roughly 4 BTC in one CoinJoin round back to a Bitget TRON wallet. The funds were converted from TRX to USDT, bridged to Ethereum via USDT0, swapped into about 145 ETH, then routed through THORChain into roughly 4.59 BTC before being split and sent into CoinJoin. AMLBot said it has blacklisted the related addresses and is monitoring the attacker’s BTC for further CoinJoin activity.

GoPlus: Bitget’s $387.5M Hack Exploited the Transaction-Signing Trust Chain, Not Private Keys GoPlus Security said its review of Bitget’s $387.5 million security incident found that the attack did not involve a private-key leak, but rather a compromise of the transaction-signing trust chain. Attackers breached a critical wallet backend system, forged transaction data, and caused Bitget’s authorized signing flow to generate valid signatures for transfers the exchange did not intend to make. GoPlus said the fund-drain window lasted about 2 hours and 25 minutes, with the largest wave moving roughly $185 million in about one minute. It has blacklisted attacker-linked addresses and shared them with ecosystem partners. GoPlus said the incident shows structural similarities to the 2025 Bybit hack, though Bitget has not yet published a full technical report and the initial intrusion method remains unconfirmed.

Bitget CEO: We're Not Going Anywhere, IPO in About Three Years During an emergency livestream on September 24, roughly three and a half hours after Bitget detected unauthorized transfers involving about $350 million, CEO Gracy Chen @GracyBitget responded to claims that the incident was self-inflicted or an inside job. Chen said staging such a hack would make no sense for a company focused on long-term growth. She said Bitget plans to pursue an IPO within the next few years — ideally in about three years — and that a major security incident would only hurt that goal. While the exact cause of the breach remains under investigation, Chen said the evidence at the time looked more consistent with the Lazarus Group.

Bitget: Withdrawals Set to Resume in Phases Starting September 28, Vulnerability Fixed Bitget said the vulnerability involved in its September 24 security incident has been identified and fixed, with withdrawals set to resume in phases after security checks are completed. The schedule is as follows, all at 08:00 UTC: BTC on September 28, ETH on September 29, USDT on September 30, and other tokens, fiat and P2P services on October 2. Bitget said user account balances remain unaffected and its Protection Fund will cover the financial impact of the incident. Trading and deposits remain operational, while Mandiant and SlowMist continue to assist with the investigation.

SEC's Best-Known Crypto Advocate Hester Peirce to Step Down According to crypto journalist Eleanor Terrett, SEC Commissioner Hester Peirce will leave the agency on October 2 after nearly nine years of service. She will join Regent University School of Law as an associate professor in November. Known as "Crypto Mom," Peirce has been a longtime advocate for the crypto industry.

Circle and Tether Freeze $318,000 Linked to Bitget Hack According to CoinDesk, Circle and Tether blacklisted an address labeled "Bitget Exploiter 8," freezing 218,023 USDT and 99,990 USDC, worth approximately $318,000 combined. Circle took action at 05:00 UTC on September 25, and MistTrack later confirmed that Tether had also blacklisted the address. The frozen funds represent only a small fraction of the stolen assets. MistTrack data shows that other attacker-linked addresses still hold more than 63,000 ETH, which stablecoin issuers cannot freeze.