We flagged ~$200k of stolen Bitget funds 9 seconds after they moved.
Circle froze it halfway through a bridge. Bitget's own Frozen board missed it for days.
Two weeks later, Bitget still hasn't decided anything.
How it happened.
Circle's bridge moves USDC by burning it on one chain and minting it fresh on another. Between those two steps, the money exists nowhere.
Sep-28, UTC
02:14:05 the hacker burns 199,999.91 USDC on Noble, to be minted at 0x9e22…03a4 on Ethereum
02:14:14 our lead 260928-101414-CYEK lands in Bitget's bounty portal
15:06:59 Circle blacklists 0x9e22…03a4. USDC can't be minted to a blacklisted address. The money is frozen mid-bridge.
0x9e22 holds zero USDC: the money isn't in any address. Their Frozen board didn't show it.
We told them that same day, through their portal and by email. Their support pointed us back to the portal, so we followed up there.
On Sep-30 their Frozen board still didn't show it. By the end of Oct-1 it did, as "CCTP not minted".
Since then, nothing. No yes, no no.
Their rule: 5% of frozen funds, "only to the first person who submits a given lead." Ours went in 9 seconds after the burn, before the money even arrived. Was anyone faster? If not, what is missing?
~$10k is about 0.003% of what was stolen. Two weeks is long enough to answer.
The ID carries Bitget's own timestamp in Beijing time: 10:14:14 = 02:14:14 UTC. Bitget can check it in one second.
Circle froze it halfway through a bridge. Bitget's own Frozen board missed it for days.
Two weeks later, Bitget still hasn't decided anything.
How it happened.
Circle's bridge moves USDC by burning it on one chain and minting it fresh on another. Between those two steps, the money exists nowhere.
Sep-28, UTC
02:14:05 the hacker burns 199,999.91 USDC on Noble, to be minted at 0x9e22…03a4 on Ethereum
02:14:14 our lead 260928-101414-CYEK lands in Bitget's bounty portal
15:06:59 Circle blacklists 0x9e22…03a4. USDC can't be minted to a blacklisted address. The money is frozen mid-bridge.
0x9e22 holds zero USDC: the money isn't in any address. Their Frozen board didn't show it.
We told them that same day, through their portal and by email. Their support pointed us back to the portal, so we followed up there.
On Sep-30 their Frozen board still didn't show it. By the end of Oct-1 it did, as "CCTP not minted".
Since then, nothing. No yes, no no.
Their rule: 5% of frozen funds, "only to the first person who submits a given lead." Ours went in 9 seconds after the burn, before the money even arrived. Was anyone faster? If not, what is missing?
~$10k is about 0.003% of what was stolen. Two weeks is long enough to answer.
The ID carries Bitget's own timestamp in Beijing time: 10:14:14 = 02:14:14 UTC. Bitget can check it in one second.