$351M Stolen , Two Crypto Security Incidents in 24 Hours| Bitget and Magic Eden

[Clearnet]

Two Major Hacks Within 24 Hours: Bitget & Magic Eden

According to reccent news within 24 hours two major Company Bitget & Magic eden has been hacked and over $351.6 million has been stolen.


1. The Bitget Issue

First the Bitget issue, although their CEO Gracy Chen Said that their Backend System has compromised which was primiarly trigger the spend/transfer authorization.

https://talkimg.com/images/2026/09/25/U0FFDc.png

Although he reportedly claimed that their private key has not been compromised which the offline vault.

Although he re assures the user's that their User Protection Fund holds more than $464 million so it covers all the stolen/lost funds.

Although this time no bitcoin has been found to compromised, their compromised tokens are:

• ~102.9M XRP
• ~31,890 ETH
• ~$75M+ in stablecoins
• ~3,000 XAUt
• BNB
• AVAX
• TRX

Largest hacking group Lazarus could be the culprint behidn this .


2. Magic Eden Contract Compromises

Another one is Magic Eden Contract compromises. It surprises me a lot.

Lets see what is does and what could have been worse .

A total of 3,832 NFTs were moved from hundreds of wallets.

Another analysis reports:

• 911 affected wallets
  
• approximately 530 WETH
  

So what actually happened is hacker group has been exploited the cotract of magic eden and they are approving all the nfts with ETH sales/transfers.

A pseudonymous security researcher 0xQuit white hack all the NFT to protect the NFT from being stolen.

https://talkimg.com/images/2026/09/25/U0FEnP.png


3. Hardware Wallets & Smart-Contract Permissions

A harware wallet can protect you private keys but it does not automatically protect you from malicious smart-contract permissions you've already granted.


4. What Could Have Been Worse?

I am wondering what would happened, if the hacker would have found a way to Modify the cotract and stolen the bitcoin from users wallet.

Since we all knows that ordinals, runes are on Brc-20 chain.

A lot disaster could have happened.
Usefull resources -
https://www.bitget.com/support/articles/12560603896024
https://x.com/GracyBitget/status/2103284265563902056
https://www.coindesk.com/markets/2026/09/25/bitget-s-usd351-million-hack-happened-via-spoofed-transfers-not-private-keys-ceo-gray-chen-says

https://itokenly.com/hacks/bitget-september-2026
https://en.bloomingbit.io/feed/news/121045
https://cryptoticker.io/en/magic-eden-limit-break-exploit-weth-nfts-revoke-approvals/
https://crypto.news/magic-eden-undergoing-possible-exploit-as-thousands-of-nfts-move-for-0-eth/

[oll]

And you've forgotten about Duelbits, they were also hacked recently.
https://bitcointalk.org/index.php?topic=5594995.msg67175752#msg67175752

[X-ray]

I am wondering what would happened, if the hacker would have found a way to Modify the cotract and stolen the bitcoin from users wallet.

Since we all knows that ordinals, runes are on Brc-20 chain.

Bitget was centralized custody failure, the fault is on the company managing their hot wallets

Magiceden on the other hand was smart contract failure and the only Bitcoin the hacker can steal is wrapped BTC, which isn't real Bitcoin but a pegged a wrapper token and only possible to happen in altcoin blockchain.

Bitcoin has nothing to do with all of that, even the entropy bug suffered by ColdCard was ColdCard's mistake.

You can rest assured that Bitcoin and its blockchain is safe and considering how ordinals work, I don't think it can drain your Bitcoin at all.

[pooya87]

1. The Bitget Issue
Although this time no bitcoin has been found to compromised, their compromised tokens are:

2. Magic Eden Contract Compromises
A total of 3,832 NFTs were moved from hundreds of wallets.

In other words these have nothing to do with bitcoin and the topic does not belong here.
Additionally this is not new nor surprising. Centralized exchanges and shitcoins gets hacked all the time, specially since the token's smart contract protocols are flawed and allow such vulnerabilities to be exploited.

I am wondering what would happened, if the hacker would have found a way to Modify the cotract and stolen the bitcoin from users wallet.

That's impossible because Bitcoin's smart contract protocol (ie. the scripts) is a solid protocol written without an exploit.

If it were anything like the shitcoins, then Bitcoin would have ceased to exist because unlike shitcoins and shittoken creation platforms, Bitcoin exists only to act as a secure payment system and if its smart contract protocol (the Scripts) had any vulnerabilities they would have been exploited long ago and would have rendered bitcoin useless already.

The only reason why flawed and broken altcoin protocols don't disappear is because nobody cares about them. People are gambling with altcoins and shittokens (eg. ETH and ETH-based tokens) and if they lose money to an exploit, it is just a bet gone wrong and they'll make new bets.

[Clearnet]

I am wondering what would happened, if the hacker would have found a way to Modify the cotract and stolen the bitcoin from users wallet.

That's impossible because Bitcoin's smart contract protocol (ie. the scripts) is a solid protocol written without an exploit.

So you're saying even though the smart contract of Magic Eden had exploited there is no way to transfer the fund from Ordinals ,  Runes? Cause smart contract are made for approving transactiom auto on behalf of us , so we don't need to transfer and sign everytime.

Or you're excluding the Ordinals , Brc-20 from main bitcoin protocols?

[asriloni]

Largest hacking group Lazarus could be the culprint behidn this .

I guess the hack is not tied to the lazarus group. The latest update by lookonchain showing us the hackers who hacked bitget wallet has withdrawn money from Binance hot wallet. We know that binance is very strct, and KYC is mandatory there. No lazarus hacker will be doing stupid thing like that.

As i know Lazarus group was always laundering their hacked money through tornado, while this hacker is withdrawing money from binance, then send it to the bitget hacker's wallet. So my assumption is that it's related to the insider instead of lazarus group.

No smart hacker would be doing such a stupid move.