Bitget is pressing parts of the DeFi (decentralized finance) sector over their response to the September 24, 2026 breach, in which attackers stole approximately $387.5 million from the exchange’s hot and warm wallets across Ethereum, Tron and the XRP Ledger. The attackers exploited a zero-day vulnerability in third-party security software to obtain high-level credentials and submit fraudulent withdrawals before covering their tracks. CEO Gracy Chen said Bitget’s cold wallets and private keys remained protected. Withdrawals were suspended and began gradually resuming on September 28, while the exchange said its User Protection Fund, valued at more than $464 million before the breach, would fully cover customer losses. NEAR Intents, a cross-chain protocol, was the main exception cited by Bitget. Its SHIELD risk-intelligence system identified and halted more than $50 million in attempted laundering linked to the hack, but froze $503,000 while transactions were executing and allowed about $166,000 to pass through before detection. Tether and Circle froze between $320,000 and $340,000 in related stolen funds, leaving estimated overall recovery at only 0.2% of the loss. Bitget had offered a 5% recovery bounty, which NEAR Intents waived. The episode has renewed debate over whether cross-chain protocols should intervene when they identify stolen assets. Possible involvement by North Korean-linked actors remains unconfirmed, and investigations are ongoing. The breach also highlights the risks created by third-party software with privileged access and may draw further regulatory scrutiny of how crypto platforms handle illicit flows.