Bitget Hack Analysis: Zero-Day Exploit and THORChain Laundering
THORChain (RUNE)
Editor:
Eugene Serbin
Dev.to reports that Bitget suffered a $387.5 million breach in late September 2026, marking one of the industry's most sophisticated exchange attacks. The incident began on September 24 with small test transfers of ETH and TRX that bypassed automated risk controls. Between 18:58 and 20:09 UTC, the attacker executed 17 large withdrawals across networks including Ethereum, XRP, and Avalanche.
Unlike typical key extractions, the private keys remained secure; instead, a zero-day vulnerability in a third-party security product was chained with stolen administrative credentials. This allowed the threat actor to inject fraudulent commands directly into the wallet backend, bypassing standard checks. The attackers systematically deleted logs after each transfer, complicating the response until Bitget halted withdrawals at 19:05 UTC and shut down signing machines at 21:44 UTC.
To launder the funds, the attackers swapped $75.48 million in stablecoins and 3,000 XAUt into native tokens like ETH and AVAX within 41 minutes. Approximately $269 million was then routed through THORChain to consolidate into Bitcoin, with Chainflip moving an additional $37.27 million. Investigators used agentic AI to compress reconciliation time from over 20 hours to under 10 minutes, though only $840,000 was frozen. Bitget’s User Protection Fund absorbed the loss, with the exchange committing to replenish it to $300 million using its $1.4 billion corporate reserves.
How the market reacted
Whalio's own Binance spot order flow for RUNE, measured when this story was written up on 4 October 2026. Not the outlet's figures.
RUNE is trading at $0.7450, with a 1-hour buy ratio of 51.7% indicating short-term buying pressure, while the 4-hour ratio of 48.3% suggests fading momentum over a slightly longer timeframe. The 24-hour buy ratio sits at 49.3%, showing a near-even split between buyers and sellers over the full day. Volume Delta for the 1-hour period is positive at +$3,462, reflecting immediate buying interest, but the 4-hour delta is negative at -$114,141, indicating that sellers have dominated the volume over the last four hours. Over 24 hours, the Volume Delta is -$26,476 and CVD closes at -$162,000, confirming that net selling pressure has outweighed buying pressure throughout the day. This means that while there are pockets of buying, the overall flow has been net negative for the session.
The latest daily buy ratio of 43.1% sits at the 2nd percentile of the last 322 days, against a median of 50.4% - among the weakest buying days it has had.
Was that an ordinary day?
The same Binance spot measurements for RUNE, averaged over the days leading up to the story.
Over the preceding week, RUNE saw a 7-day average buy ratio of 53.1%, making today's 24-hour ratio of 49.3% a decline of 3.8 points from the weekly norm. Spot volume for the day was $1,969,824, which is only 0.14 times the average daily volume, signaling a significant drop in trading activity compared to the previous week. While the coin experienced net buying on 6 of the last 7 days, the current day represents a deviation from that consistent upward flow. The price has dropped 3.7% over the eight-day period, contrasting with the +$7,501,902 total volume delta recorded over that same timeframe. This suggests that while the broader week saw accumulation, today’s activity is unusually quiet and slightly bearish relative to the recent trend.