What happened this week?
The Bitget exchange confirmed a security incident. According to BitHub.pl, it detected unauthorized transfers from part of its hot wallets on September 24, 2026 at 20:31 Polish time, with estimated damages around 350 million dollars (BitHub.pl). CEO Gracy Chen later stated that a preliminary investigation pointed to IP addresses matching a VPN choice associated with a North Korean hacking group (Cointelegraph).
The second half of the story only began after the theft. According to Cointelegraph, THORChain won't (or can't) block addresses linked to the hack, which this piece puts at 387.5 million dollars, raising the question of whether its developers could be prosecuted for money laundering (Cointelegraph).
We deliberately placed three different figures here: ~350 million, 352 million, and 387.5 million dollars. This isn't a mistake, it's the first lesson. The damage estimate shifts over the first hours and days depending on who is counting, at what moment, and how many addresses they've already folded into the calculation.
Which number moved first and what does it mean?
The price didn't move first, nor did the headline. The hot wallet outflow moved first.
An exchange hot wallet (the address from which an exchange handles routine withdrawals) is public. When funds start draining from it outside the usual pattern, it's visible on the chain before anyone can announce anything. In Bitget's case the gap between detection and announcement is literally measured in minutes: the detection time of September 24 at 20:31 Polish time is, according to BitHub.pl, the moment the attackers were recorded, while the official communication came only afterward (BitHub.pl).
Why does this matter? Because the order of the numbers tells you about the cause.
| Number | Moment | What it says | Source |
|---|---|---|---|
| Unauthorized outflow from hot wallets | Sep 24, 2026, 20:31 PL | First observable signal that something is happening | BitHub.pl |
| Damage estimate ~350 to 387.5 million USD | hours to days later | Shifts as more addresses are included | BitHub.pl, Cointelegraph |
| IP traces to a DPRK group | after preliminary investigation | A clue to the perpetrator, not proof | Cointelegraph |
The on-chain signal (the outflow) is a hard observation. The damage estimate is a calculation that matures. Attribution (who's behind it) is the softest layer, because an IP through a VPN is a clue, not confirmation.
What to take away for next time?
Three practical habits for reading the data, no advice to buy or sell.
1. In an exchange incident, watch the outflow, not the headline. Public exchange addresses are observable in real time. Official announcements arrive with a delay and often soften the wording. If you want to know what happened, look at the movement of funds, not the tone of the statement.
2. Expect the first damage figure to change. The difference between 350 and 387.5 million isn't a contradiction, it's the natural evolution of an estimate. Treat the first number as a lower bound at time t, not as a final verdict.
3. Censorship resistance cuts both ways. The fact that THORChain doesn't block addresses is a feature for some (no one can freeze your funds) and a problem for others (no one freezes the stolen funds either). The same technical property has two faces depending on which side of the transaction you're on (Cointelegraph).
For market context: in the week this was being dealt with, Bitcoin was holding near 84,000 dollars according to Cointelegraph (Cointelegraph). Our own measurements showed BTC around 84 thousand dollars (+0.9% over 24h), a NEUTRAL regime, and Fear & Greed at 74. In other words: a hack of this scale produced no visible tremor in the broader market. That in itself is an observation, not a cause.
What don't we know yet?
- The exact final damage. The figures differ across our sources (~350 to 387.5 million USD) and no definitive total is known.
- Who carried out the attack. The IP traces to a DPRK group are a clue from a preliminary investigation, not proven attribution (Cointelegraph).
- Whether THORChain developers will be prosecuted. According to the cited lawyer, the legal situation is unclear and there's no answer yet (Cointelegraph).
- How much of the funds will be recovered. At the time of writing, this cannot be reliably quantified from the available sources.
In the end, the lesson is simple. In crypto incidents, the truth emerges in layers: first the hard on-chain signal, then the maturing estimate, finally the uncertain attribution. Whoever doesn't confuse these layers reads the market more accurately than someone who waits for the headline.