On September 4, 2026, on-chain monitor Specter flagged a coordinated drain targeting more than 600 wallets suspected to be linked to the GoMining hack, the Bitcoin mining and rewards platform.
Combined losses total approximately $2.8 million. Attackers moved fast, swapping and bridging stolen assets across multiple chains before consolidating everything into roughly 1,147 ETH.
What Happened: A Tagged Service Wallet, 600+ Addresses, One Exit Route
The bulk of the damage came from a single wallet. A service address tagged on-chain as GoMining lost approximately $2.79 million, almost the entire haul in one hit.
The remaining losses spread across 600-plus other addresses. Most of those wallets had one thing in common: a prior history of holding GMT, the platform’s native token for mining allocation and ecosystem access.
That shared token history is what led Specter to cluster them together.
That said, holding GMT alone does not confirm platform affiliation for every address. The link between the drained wallets and GoMining remains on-chain inference, not company confirmation.
The suspected theft address, 0xa73…4704, was flagged by CoinGabbar as the destination point of the initial drain.
Once the wallets were emptied, the attacker followed a pattern now familiar in 2026’s cluster exploits. Stolen tokens were swapped across assets, bridged across multiple networks, then settled as ~1,147 ETH.
Cross-chain movement of this kind is designed to slow tracing. However, on-chain analytics firms like Specter can often follow the trail as it consolidates.
What Investors Should Watch: GMT Demand, Bitget Pause, and an Unanswered Question
GoMining is no longer a niche cloud-mining app. Its 2026 product stack includes NFT miners, Simple Earn, Instant Funds, GoBTC Pay, and the GMT utility token, a full ecosystem pitch to retail investors.
First: was this user self-custody, platform infrastructure, or both? Second: does GoMining’s GMT token face demand pressure if users now treat ecosystem wallets as a security risk?
Third: does Bitget’s concurrent GOMINING-ETH deposit and withdrawal suspension, announced on September 5, 2026, at 07:28 UTC+8, citing “wallet maintenance”, point to a coordinated containment effort?
A GoMining ambassador account separately noted on X that withdrawals were blocked and that GMT had sold off.
The account argued the platform was large enough to absorb the hit. That is community color, not official guidance.
Until GoMining issues a statement, markets are pricing this as unconfirmed operational risk, not a proven protocol exploit. Watch GoMining’s official X account for any first response.
This incident fits a wider 2026 pattern. Earlier this year, a mystery exploit drained hundreds of EVM wallets in a similarly coordinated sweep.
Around the same time, Humanity Protocol suffered a private-key compromise that triggered a sharp token crash.
In each case, fast multi-chain consolidation into ETH was the attacker’s chosen exit, the same playbook visible here.
For background on GoMining’s recent growth push, former Kraken CEO Tal Cohen joined the platform’s advisory board earlier in 2026.
The platform also launched its GoBTC Pay SDK to bring native Bitcoin payments into everyday commerce.
Those growth signals now sit alongside an unresolved GoMining hack allegation that the company has yet to address publicly.
Our guide covers proven strategies to earn passive income with crypto in any market condition.
Be the first to comment