A suspected attack on GoMining, the Bitcoin mining and rewards platform, emptied more than 600 wallets for about $2.8 million on Sept. 4, with funds consolidated into roughly 1,147 ETH. Bitget paused GOMINING-ETH trading as GoMining has yet to confirm the breach or its root cause.
Specter flagged a coordinated drain of more than 600 wallets linked to GoMining on Sept. 4, with combined losses near $2.8 million that attackers consolidated into roughly 1,147 ETH.
The on-chain monitor attributed the bulk of the damage to a single service address tagged as GoMining, which lost about $2.79 million before the stolen assets were swapped and bridged across multiple chains, according to Specter's investigation. Most of the remaining addresses shared a prior history of holding GMT, the platform's native token for mining allocation and ecosystem access, which is what led Specter to cluster them together. The suspected theft address, 0xa73…4704, was flagged by CoinGabbar as the destination of the initial drain.
Holding GMT alone does not confirm platform affiliation for every address, and GoMining has not confirmed the link. That distinction now defines the risk. Bitget suspended GOMINING-ETH deposits and withdrawals on Sept. 5 at 07:28 UTC+8, citing "wallet maintenance," a move that could signal coordinated containment. A GoMining ambassador account said on X that withdrawals were blocked and GMT had sold off, arguing the platform was large enough to absorb the hit — community color, not official guidance.
GoMining has yet to issue a statement, leaving markets to price the incident as unconfirmed operational risk rather than a proven protocol exploit. The platform's 2026 product stack — NFT miners, Simple Earn, Instant Funds, GoBTC Pay and the GMT utility token — has pitched it to retail as a full ecosystem, which raises the stakes of a security failure touching 600-plus wallets.
The pattern fits a wider 2026 cluster-exploit wave. Earlier this year a mystery exploit drained hundreds of EVM wallets in a coordinated sweep, and Humanity Protocol suffered a private-key compromise that triggered a sharp token crash. In each case attackers consolidated into ETH as the exit route, the same playbook visible here.
For GoMining the timing is awkward. Former Kraken CEO Tal Cohen joined the platform's advisory board earlier in 2026, and GoMining launched its GoBTC Pay SDK to push native Bitcoin payments into commerce. Those growth signals now sit alongside an unresolved hack allegation the company has yet to address.
What to watch: GoMining's official X account for a first response, and whether GMT demand weakens if users treat ecosystem wallets as a security risk. Until the platform details the root cause — user self-custody, platform infrastructure, or both — the drain will keep weighing on trust in mining-reward platforms.
This article is for informational purposes only and does not constitute investment advice.
