{
 "tag": "optimism",
 "name": "Optimism",
 "group": "Chains",
 "incidents": [
  {
   "slug": "bitget-hot-wallet-breach-zero-day-sep-2026",
   "title": "Bitget hot and warm wallets drained of $387.5M after zero-day in third-party security appliances",
   "url": "https://drains.watch/i/bitget-hot-wallet-breach-zero-day-sep-2026",
   "json": "https://drains.watch/i/bitget-hot-wallet-breach-zero-day-sep-2026.json",
   "status": "live",
   "severity": "critical",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "ethereum",
    "arbitrum",
    "avalanche",
    "optimism",
    "bsc",
    "base"
   ],
   "method": null,
   "product": "Bitget exchange hot and warm wallets",
   "tags": [
    "ethereum",
    "arbitrum",
    "avalanche",
    "optimism",
    "bsc",
    "base",
    "exchange",
    "bitget",
    "hot-wallet",
    "zero-day",
    "infrastructure-breach",
    "dprk"
   ],
   "amountUsd": 387500000,
   "victims": null,
   "startedAt": "2026-09-24",
   "closedAt": "2026-09-28",
   "updatedAt": "2026-10-15T12:00:00Z",
   "summary": "Attackers exploited a zero-day in two third-party security appliances at exchange Bitget, moved on to its production wallet job server and used a custom withdrawal tool to drain hot and warm wallets on 24-25 September 2026. The confirmed loss is about $387.5 million (first reported as $351.6M) across Ethereum, Arbitrum, Avalanche, Optimism, BSC, Base and the XRP Ledger. Bitget's CEO blamed North Korean hackers, and Bitget said cold wallets and private keys were not compromised. Hacken's Q3 figures say about $387M was covered by Bitget's user protection fund."
  },
  {
   "slug": "aerodrome-velodrome-dns-hijack-nov-2025",
   "title": "Aerodrome and Velodrome front-ends hijacked via DNS, cloned sites serve Eleven Drainer",
   "url": "https://drains.watch/i/aerodrome-velodrome-dns-hijack-nov-2025",
   "json": "https://drains.watch/i/aerodrome-velodrome-dns-hijack-nov-2025.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "base",
    "optimism"
   ],
   "method": "front-end-hijack",
   "product": "Aerodrome (Base) and Velodrome (Optimism) web app users",
   "tags": [
    "base",
    "optimism",
    "front-end-hijack",
    "aerodrome",
    "velodrome",
    "dns-hijack",
    "eleven-drainer",
    "drainer-as-a-service",
    "approval-phishing",
    "dex"
   ],
   "amountUsd": 700000,
   "victims": null,
   "startedAt": "2025-11-21",
   "closedAt": "2025-12-02",
   "updatedAt": "2025-12-02T12:00:00Z",
   "summary": "On 21 November 2025 an attacker changed the DNS records for aerodrome.finance and velodrome.finance, sending visitors to a cloned front-end running 'Eleven Drainer' code. Users who signed on the fake site lost tokens: Blockaid tied about $700K to nine attacker addresses, and Halborn put losses above $1M. The smart contracts were not touched. Anyone who signed on either site that evening should revoke approvals they don't recognise."
  }
 ],
 "changes": [
  {
   "incident": "bitget-hot-wallet-breach-zero-day-sep-2026",
   "incidentTitle": "Bitget hot and warm wallets drained of $387.5M after zero-day in third-party security appliances",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-10-15",
   "title": "Hacken's Q3 data showed about $387M covered by Bitget's user protection fund; Circle and Tether froze about $340,000 tied to the theft.",
   "sourceUrl": "https://cointelegraph.com/news/bitget-liquid-exploits-push-crypto-hacks-near-12b-q3",
   "url": "https://drains.watch/i/bitget-hot-wallet-breach-zero-day-sep-2026"
  },
  {
   "incident": "bitget-hot-wallet-breach-zero-day-sep-2026",
   "incidentTitle": "Bitget hot and warm wallets drained of $387.5M after zero-day in third-party security appliances",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-10-01",
   "title": "The confirmed loss was put at $387.5 million, up from the first estimate of $351.6 million.",
   "sourceUrl": "https://crypto.news/crypto-loses-768m-in-worst-hack-month-of-2026/",
   "url": "https://drains.watch/i/bitget-hot-wallet-breach-zero-day-sep-2026"
  },
  {
   "incident": "bitget-hot-wallet-breach-zero-day-sep-2026",
   "incidentTitle": "Bitget hot and warm wallets drained of $387.5M after zero-day in third-party security appliances",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-09-28",
   "title": "Bitget resumed Bitcoin withdrawals.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/bitget-resumes-bitcoin-withdrawals-after-3875-million-crypto-heist/",
   "url": "https://drains.watch/i/bitget-hot-wallet-breach-zero-day-sep-2026"
  },
  {
   "incident": "bitget-hot-wallet-breach-zero-day-sep-2026",
   "incidentTitle": "Bitget hot and warm wallets drained of $387.5M after zero-day in third-party security appliances",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-09-25",
   "title": "A custom withdrawal tool drained hot and warm wallets over nearly three hours after midnight (UTC+8); Bitget suspended withdrawals.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/bitget-hacked-via-zero-day-in-third-party-security-products/",
   "url": "https://drains.watch/i/bitget-hot-wallet-breach-zero-day-sep-2026"
  },
  {
   "incident": "bitget-hot-wallet-breach-zero-day-sep-2026",
   "incidentTitle": "Bitget hot and warm wallets drained of $387.5M after zero-day in third-party security appliances",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-09-24",
   "title": "Per Mandiant, the attacker gained privileged access to two third-party security appliances, then reached the wallet job server and deployed malicious packages.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/bitget-hacked-via-zero-day-in-third-party-security-products/",
   "url": "https://drains.watch/i/bitget-hot-wallet-breach-zero-day-sep-2026"
  },
  {
   "incident": "bitget-hot-wallet-breach-zero-day-sep-2026",
   "incidentTitle": "Bitget hot and warm wallets drained of $387.5M after zero-day in third-party security appliances",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-08-31",
   "title": "SlowMist's report traced the earliest malicious activity in Bitget's logs to 31 August.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/bitget-hacked-via-zero-day-in-third-party-security-products/",
   "url": "https://drains.watch/i/bitget-hot-wallet-breach-zero-day-sep-2026"
  },
  {
   "incident": "aerodrome-velodrome-dns-hijack-nov-2025",
   "incidentTitle": "Aerodrome and Velodrome front-ends hijacked via DNS, cloned sites serve Eleven Drainer",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-12-02",
   "title": "Halborn's November review listed the DNS hijack with over $1M lost through malicious token approvals.",
   "sourceUrl": "https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-november-2025",
   "url": "https://drains.watch/i/aerodrome-velodrome-dns-hijack-nov-2025"
  },
  {
   "incident": "aerodrome-velodrome-dns-hijack-nov-2025",
   "incidentTitle": "Aerodrome and Velodrome front-ends hijacked via DNS, cloned sites serve Eleven Drainer",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-11-24",
   "title": "Blockaid published its analysis: about $700K stolen to nine attacker addresses, about $3.5M in drains blocked, and 408 users warned at connect and 491 at signing.",
   "sourceUrl": "https://www.blockaid.io/blog/how-blockaids-customer-data-network-contained-the-aerodrome-dns-attack",
   "url": "https://drains.watch/i/aerodrome-velodrome-dns-hijack-nov-2025"
  },
  {
   "incident": "aerodrome-velodrome-dns-hijack-nov-2025",
   "incidentTitle": "Aerodrome and Velodrome front-ends hijacked via DNS, cloned sites serve Eleven Drainer",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-11-21",
   "title": "At 20:11 UTC the attacker changed the SOA, NS and A records so both domains pointed to a cloned front-end running Eleven Drainer code.",
   "sourceUrl": "https://www.blockaid.io/blog/how-blockaids-customer-data-network-contained-the-aerodrome-dns-attack",
   "url": "https://drains.watch/i/aerodrome-velodrome-dns-hijack-nov-2025"
  },
  {
   "incident": "aerodrome-velodrome-dns-hijack-nov-2025",
   "incidentTitle": "Aerodrome and Velodrome front-ends hijacked via DNS, cloned sites serve Eleven Drainer",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-11-21",
   "title": "Blockaid detected malicious transaction patterns at 21:31 UTC and flagged the domain as malicious a minute later; the first user report came at 22:07 UTC.",
   "sourceUrl": "https://www.blockaid.io/blog/how-blockaids-customer-data-network-contained-the-aerodrome-dns-attack",
   "url": "https://drains.watch/i/aerodrome-velodrome-dns-hijack-nov-2025"
  },
  {
   "incident": "aerodrome-velodrome-dns-hijack-nov-2025",
   "incidentTitle": "Aerodrome and Velodrome front-ends hijacked via DNS, cloned sites serve Eleven Drainer",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-11-21",
   "title": "Nameservers were replaced at 22:40 UTC as remediation began.",
   "sourceUrl": "https://www.blockaid.io/blog/how-blockaids-customer-data-network-contained-the-aerodrome-dns-attack",
   "url": "https://drains.watch/i/aerodrome-velodrome-dns-hijack-nov-2025"
  }
 ]
}