BreachPublished 30 Sep 2026

Bitget hacked via zero-day in third-party security products

Source Bleeping Computer

zero-day

Description

Cryptocurrency exchange Bitget suffered a major breach resulting in the theft of $387.5 million. Attackers exploited zero-day vulnerabilities in two third-party security appliances to gain unauthorized privileged access. They deployed web shells and malware to move laterally into Bitget's wallet infrastructure, ultimately compromising hot and warm wallets across multiple blockchain networks. The attack spanned several hours and affected multiple assets including ETH, XRP, BNB, AVAX, USDT, and USDC. Bitget has suspended withdrawals and launched a recovery bounty program. The attackers are attributed to North Korean threat actors based on IP and on-chain analysis.

Impact

The breach resulted in the theft of $387.5 million in cryptocurrency from Bitget's hot and warm wallets. Multiple blockchain assets and networks were affected, causing significant financial loss and operational disruption including suspension of withdrawals. The attackers gained unauthorized privileged access to critical backend systems, enabling them to spoof transaction data and bypass authorization controls. The incident damages Bitget's security posture and trustworthiness in the cryptocurrency exchange market.

Defensive guidance

Bitget has suspended all withdrawals to prevent further unauthorized transfers and launched a Recovery Bounty Program to incentivize recovery or freezing of stolen funds. Organizations using similar third-party security products should monitor vendor advisories closely for patches or mitigations. Until fixes are available, consider isolating or restricting access to critical security appliances and wallet infrastructure to reduce attack surface.

Summary

Bitget was breached after attackers exploited zero-day vulnerabilities in two third-party security products used as security appliances. The attackers gained privileged access to these appliances, deployed web shells and malware, and moved laterally to Bitget's production wallet job server. They then used a custom withdrawal tool to steal $387.5 million from hot and warm wallets across multiple blockchains including Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC, and Base. The breach was detected after unauthorized transfers were observed, leading to suspension of withdrawals. Investigations by SlowMist and Mandiant confirmed the attack timeline and methods. The attackers are linked to North Korean hacking groups known for previous large-scale crypto thefts.

References

bleepingcomputer.com/news/security/bitget-hacked-via-zero-day-in-third-party-security-products/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 30 Sep 2026, 11:42 UTC

References

Community reviews

Related threats