Author: Shao Jiadong
Another exchange hack has happened—again. This time, the amount involved was approximately $350 million, and the victim was Bitget.
In the early hours of September 25, 2026, Bitget suffered a sudden security incident. According to the security notice published by the platform, at 02:31:11 Beijing time, the system detected abnormal transfers from some hot and warm wallets. The preliminary assessment put the amount involved at approximately $351.6 million, while cold wallets were unaffected. Bitget said the related losses are covered by its user protection fund and temporarily suspended withdrawals, pending an orderly resumption after the security review is completed.
Bitget's security notice published on September 25, 2026 (screenshot source: Bitget official website)
The more news like this I see, the harder it is for me to focus only on "how much was lost this time." The more practical question is: through whose hands will the money pass next, and which participants still have time to do something? How the losses are compensated first tests Bitget; whether the funds can be intercepted also involves the exchanges, exchange services, cross-chain protocols, aggregator applications along the way, and the people who actually hold operational permissions within them.
After the incident, Bybit co-founder and CEO Ben Zhou said he was willing to offer help to Bitget and said the team was updating the LazarusBounty platform to assist in tracking the flow of the stolen funds. In a moment of crisis, a competitor being willing to lend a hand is a kind of industry mutual aid that deserves recognition.
Similar mutual aid has appeared in previous hacking incidents. After Bybit was hacked in 2025, Bitget CEO Gracy Chen publicly offered to assist with tracking and investigation. According to Bybit's official incident timeline, Bitget also transferred 40,000 ETH to Bybit at the time to provide liquidity support. Providing liquidity and recovering stolen assets are two different tasks, yet together they illustrate one thing: after a major security incident, it is difficult for a single platform to complete all responses on its own.
After the expressions of support, the truly difficult work begins. Stolen assets may quickly be swapped into other tokens, split across multiple addresses, or bridged to another chain. The services the funds pass through along the way include some that can control custodial accounts, some that hold unsettled trades, and some that can only manage front-end access, routing, or part of the execution process. Investigators and the victim must quickly identify the entities that truly have the ability to take action.
Collaboration on asset recovery truly tests three things: whether on-chain addresses can be mapped to specific transactions, whether operational permissions can be translated into disposal actions, and whether temporary measures can be smoothly connected to formal procedures.
These three things also determine the order of discussion in this article. Public statements can convey goodwill; whether the funds can be intercepted requires answering layer by layer who controls this link, how far the transaction has progressed, what measures the existing materials support, and how disclosure, preservation, and return are to be completed afterward.
Step one: first identify who truly holds disposal authority
To turn industry support into action, the first step is to identify who holds actual authority in the relevant transactions. Service providers that receive assets, complete conversions, and then make payments may control assets that have not yet been settled; custodial exchanges may control associated accounts and deposit/withdrawal permissions; operators of cross-chain protocols or aggregator applications may control only the front end, routing, transaction forwarding, or part of the execution process.
In determining whom to approach for assistance, platform names and technical labels can only provide a starting point. What is truly useful is the business process and control relationships. The victim can use this to identify the entities capable of receiving requests; operators who receive requests can also use this to confirm what exactly they can pause, verify, preserve, and what falls beyond their authority.
Legal obligations must also be determined in light of the specific business and applicable jurisdiction. According to the international standards of the Financial Action Task Force (FATF), virtual asset service providers should generally implement preventive measures such as customer due diligence, record keeping, and suspicious transaction reporting, with the specific scope of application and manner of implementation determined by the laws of each jurisdiction. Statutory verification, preservation, or reporting obligations that have already been triggered should be performed in accordance with applicable provisions; whether transactions may also be restricted or information provided to specific parties requires separate assessment.
This analysis also applies to businesses that use decentralized technology. In its July 2026 DeFi thematic report, FATF focused on who has control or sufficient influence over the relevant arrangements and listed factors such as administrative permissions, upgrade control, governance token concentration, and infrastructure influence. The report provides an analytical framework under international standards, while specific obligations still need to be referred back to local law. For cross-chain protocols and aggregator applications, what services the operator actually provides and which links it controls are usually more informative than the label "decentralized."
Step two: map on-chain addresses to specific transactions
After identifying the entities that may receive requests, the next step is to map the on-chain fund path to the other party's accounts, orders, and business records. Address labels can only indicate the direction of tracking; only when they are tied to specific transactions can the relevant operators more easily determine whether the funds are still within their control and what disposal options exist at the current stage.
When the victim platform or its authorized agent makes a request for assistance, it can try to explain the case, the blockchain involved, transaction hashes, token types, amounts, times, relevant addresses, and how these leads relate to the recipient's business. The service provider receiving the request can, according to its own procedures, verify the identity of the requester, the source of the materials, and the connection to its own transactions. How far the transaction has been executed is an important clue for determining the scope for action.
For services that receive funds first and then convert and pay out, not yet converted, converted but not yet paid, and already paid correspond to different states of control. For cross-chain or aggregation services, operators can, based on the information they lawfully hold, verify the source-chain transaction, conversion request, destination-chain address, and execution status. What exactly needs to be verified should be determined in light of the business architecture, lawfully held information, and applicable requirements.
Once external leads correspond to actual accounts, a custodial exchange may be able to take measures if it has the authority and basis to do so. According to disclosures by Elliptic, in 2023 Binance and Huobi froze accounts containing approximately $1.4 million in crypto assets based on intelligence it provided, with the related funds originating from the earlier Harmony Horizon cross-chain bridge attack. What made this case work was that external tracking results corresponded to accounts controlled by the exchange. Whether other platforms or protocols can take similar measures still depends on their respective permissions, evidence, and applicable procedures.
Elliptic discloses its collaboration with Binance and Huobi to freeze stolen funds related to the Lazarus Group (screenshot source: Elliptic official website)
Step three: choose appropriate measures according to the stage of the transaction
Once leads correspond to specific transactions, the question shifts from "what has been found" to "what can still be done now." Restricting access points, pausing conversions, delaying payments, and restricting outbound transfers from custodial accounts differ in their targets, sources of authority, and scope of impact. Operators need to make judgments among the urgency of stopping funds from continuing to move, the credibility of the existing materials, and the rights and interests of normal traders.
When unsettled assets are still under the service provider's control, the service provider can assess the feasibility of suspending conversions or delaying payments in light of applicable law, contractual arrangements, technical capabilities, and the impact on relevant users. The fact that a transaction has not yet been fully executed does not automatically create an obligation to freeze or return funds, but it may leave time for temporary verification. When a custodial exchange faces associated accounts, it also needs to review the specific basis, scope, and continuing conditions for restricting outbound transfers.
Operators of cross-chain protocols and aggregator applications should first sort out which links they control. If they manage only the front-end interface, measures can usually affect only that access point; if they also control transaction forwarding or execution permissions, there may be other room for intervention. When contract suspension or upgrades are involved, multisig arrangements, governance procedures, and the impact on other users will also affect whether measures are feasible.
Access restrictions can reduce the risk that a specific service continues to be exploited, and their actual effect depends on the service architecture and other access paths. If users can still use other access points or call contracts directly, the effect of restricting a single front end will be relatively limited.
OKX's announcement on March 17, 2025 provides a real-world example. OKX said that after discovering that Lazarus was attempting to abuse its DeFi services, it proactively suspended its DEX aggregation service and upgraded preventive measures after communicating with regulators; the announcement also stated that the aggregator connects liquidity from multiple protocols and does not itself custody customer assets. This case shows that non-custodial services can also adjust the products and access points they control. Whether funds in the underlying protocols can be frozen still depends on the actual architecture and control permissions.
When relevant operators take temporary measures, they can also simultaneously consider the scope of application, review milestones, conditions for lifting, and record retention. For law enforcement or judicial orders that are legally binding and applicable to the party concerned, they should be handled in accordance with their effect and scope; where there are doubts about the scope of execution or technical feasibility, they may explain and seek clarification through the corresponding procedures. Even if the funds have already been transferred out, lawfully retained account, order, login, and communication records may continue to assist subsequent recovery efforts.
Step four: connect temporary restrictions to formal return proceduresFunds being temporarily stopped only buys a window for handling. Whether they can ultimately be returned still depends on answering who the assets belong to, what can be delivered, to whom they should be delivered, and under what procedures delivery should occur. After exchanges and multiple transfers, counterparties may present their own bases for lawful transactions and acquisition of assets; once funds enter an exchange’s liquidity pool, claimants may also need to further prove the connection between the controlled assets and the originally stolen funds.
Temporarily restricting transfers and ultimately returning assets often correspond to different conditions and evidentiary requirements. An entity that only manages the front end and does not control the relevant assets may mainly be able to provide records of lawful possession; when entities that hold customer information or order information disclose information externally, they also need to consider the recipient, scope of disclosure, confidentiality obligations, and personal information protection requirements.
Judicial measures also require claimants to have their evidence and procedures properly prepared. In the 2023 judgment in the U.K. Piroozzadeh case, the victim obtained a temporary property injunction without notifying Binance, and the court later set aside the injunction because the applicant had not presented the case fully and fairly. The judgment discussed defenses an exchange might raise of good-faith acquisition for value, as well as issues such as how to identify and enforce preservation once funds are commingled in a pool. The case dealt with an application for a temporary injunction and did not ultimately adjudicate ownership of the assets, but it reminds claimants that converting on-chain tracing results into judicial measures still requires satisfying the corresponding evidentiary and procedural requirements.
The public rules of exchange services can also reflect this distinction. ChangeNOW’s public cooperation statement requires the requesting party to provide case details, transaction information, a list of addresses, and information on law enforcement procedures; Article 6.11 of its terms of service also states that, depending on when a report is received, the platform may only intercept a transaction after the exchange has been completed, in which case the assets that can be returned may be in the post-exchange currency. Under that provision, return also requires an explicit request from law enforcement authorities. This is the handling mechanism publicly disclosed by ChangeNOW; how other service providers handle such matters still depends on applicable law, contractual arrangements, asset status, and specific procedures.
What different participants should do first, respectively
When the preceding analysis is put into practice, the greatest fear is that “everyone is willing to help, but no one knows who should send the next email, what should be attached, and who should judge the matter after it is received.” The flow of funds will not wait for all parties to slowly become familiar with the process. Based on the authority of different roles, the following items can serve as a reference when initiating handling.
For the victimized platform or project party: priority can be given to fixing the incident timeline, organizing transaction hashes, involved addresses, currencies, amounts, and on-chain paths, and preparing ownership, police report, and authorization materials. External cooperation requests should preferably be sent through a unified window, clearly stating what the other party is being asked to verify, the extent to which existing leads support the matter, and how subsequent formal procedures are being advanced.
For operators such as exchanges and exchange services: after receiving leads, they can first check related accounts, orders, and transaction stages, preserve KYC, login, device, communication, and operation records, and then have business, technical, compliance, and legal personnel assess measures that can be taken in light of their own authority. Matters not yet confirmed can be described as still under review; measures already taken and their limitations can also be fed back to the requesting party within the scope permitted by law for communication.
For cross-chain protocols, aggregators, and related operators: as soon as possible, they can distinguish among smart contracts, front ends, routing, APIs, upgrade permissions, and governance mechanisms, and confirm which links are actually controlled by them. When planning to adjust entry points, suspend services, or initiate multisig or governance procedures, they should also assess other access paths, impacts on ordinary users, and restoration conditions, and retain the factual and authority explanations on which the decision was based.
For lawyers and on-chain investigation teams: the focus of the work is to organize the on-chain path into a factual record that can be understood by the platform internally, by law enforcement authorities, and by courts, and to map each request to a specific entity, authority, and procedure. Where multiple jurisdictions or multiple service providers are involved, it is also necessary to design the sequence for transmitting materials and taking action, so that leads do not remain stuck in an address list, and so that temporary restrictions do not become disconnected from subsequent preservation, disclosure, and return.
The earlier all parties collaborate on the same factual record, the easier it is for verification, restriction, disclosure, and return to connect. Relevant operators can also establish, in ordinary times, a risk lead intake channel and internal decision-making process, clarifying who receives requests, who determines transaction connections, who assesses legal basis, and under what circumstances the matter needs to be escalated to management or an external professional team.
Whether liability is borne ultimately still depends on specific evidence
Only after collaboration moves forward can the issue of liability be discussed more accurately. A slow reply, a mistaken risk judgment, a continuing violation of statutory anti-money laundering requirements, and knowingly helping to transfer criminal funds correspond to different facts and legal assessments. For protocols or applications, liability also needs to be attributed to specific operators or controllers; identities such as developer or governance participant are not by themselves sufficient to directly establish liability.
At the regulatory level, the first step is to confirm whether the relevant entity is an obligated entity under applicable law, and then to determine the specific customer due diligence, record-keeping, and reporting requirements. The FATF standard on suspicious transaction reporting requires countries to provide by law that financial institutions promptly report to the financial intelligence unit when they suspect or have reasonable grounds to suspect that funds are the proceeds of crime. For virtual asset service providers subject to local law, the reporting entity, triggering conditions, and manner of performance still depend on local regulations.
Submitting a suspicious transaction report to a statutory body and disclosing customer information to a victim are two different types of conduct, with different bases and boundaries. Reported information may also be subject to confidentiality restrictions. Whether the relevant operator can externally state that it has already reported or is investigating needs to be determined in light of applicable rules; where more serious allegations such as assisting money laundering are involved, specific conduct, subjective knowledge, and other elements required by local law must be proven by evidence.
In the 2025 investigation by German law enforcement authorities into the crypto asset exchange service eXch, attention was focused simultaneously on fund flows and the platform’s business model. Elliptic had traced and found that some of the ETH stolen from Bybit was exchanged into BTC through services such as eXch. Thereafter, the German Federal Criminal Police Office reported that on April 30, 2025, law enforcement authorities seized eXch’s servers in Germany and crypto assets then worth approximately EUR 34 million, and that the operators were suspected of commercial money laundering and operating an internet platform for criminal transactions. The report also mentioned that the service had advertised on the dark web that it did not adopt anti-money laundering measures and did not require users to verify their identities. The relevant criminal allegations still must be proven in accordance with legal elements and evidence.
The lesson from this case is direct: investigative authorities focus not only on where funds passed through, but also on how a service solicited business, how it organized exchanges, and what actions it took when faced with risk leads. Retaining necessary verification and decision-making records helps operators explain when they discovered risk, what authority they had at the time, and why they took or did not take a certain measure. The scope of records and retention periods should still comply with applicable regulations, and their evidentiary value also needs to be assessed together with other evidence.
Mankun Lawyers’ brief summary
After seeing many similar incidents, I increasingly feel that the outcome of asset recovery often depends on a very simple thing: whether all parties can, in the shortest possible time, connect authority, evidence, and procedure. Public expressions of support can show the industry’s warmth; actually stopping assets, getting materials into investigations, and giving return a basis still require specific work item by item.
The hardest part of such matters is usually piecing together on-chain paths, account and order information, business control authority, legal basis, and cross-border procedures into an enforceable recovery chain. The earlier on-chain investigators, platform compliance staff, technical personnel, and lawyers collaborate around the same factual record, the easier it is for subsequent verification, restriction, disclosure, preservation, and return to connect. For institutions that have already experienced abnormal asset flows, or that may receive cooperation requests, completing authority mapping, evidence preservation, and response path design as early as possible can also reduce the risk of missing the handling window.
What users entrust to platforms is assets, and also trust. A true sign of the industry’s maturity is that after every incident, publicly expressed goodwill can be transformed into evidence-based, enforceable, and traceable action.
I hope that in the future we will see fewer “again” and more statements of “it has been recovered” supported by evidence.