Bitget was breached after attackers exploited zero-day vulnerabilities in two third-party security products used as security appliances. The attackers gained privileged access to these appliances, deployed web shells and malware, and moved laterally to Bitget's production wallet job server. They then used a custom withdrawal tool to steal $387.5 million from hot and warm wallets across multiple blockchains including Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC, and Base. The breach was detected after unauthorized transfers were observed, leading to suspension of withdrawals. Investigations by SlowMist and Mandiant confirmed the attack timeline and methods. The attackers are linked to North Korean hacking groups known for previous large-scale crypto thefts.

The breach resulted in the theft of $387.5 million in cryptocurrency from Bitget's hot and warm wallets. Multiple blockchain assets and networks were affected, causing significant financial loss and operational disruption including suspension of withdrawals. The attackers gained unauthorized privileged access to critical backend systems, enabling them to spoof transaction data and bypass authorization controls. The incident damages Bitget's security posture and trustworthiness in the cryptocurrency exchange market.

No official patch or remediation details for the exploited zero-day vulnerabilities in the third-party security appliances have been disclosed. Bitget has suspended all withdrawals to prevent further unauthorized transfers and launched a Recovery Bounty Program to incentivize recovery or freezing of stolen funds. Organizations using similar third-party security products should monitor vendor advisories closely for patches or mitigations. Until fixes are available, consider isolating or restricting access to critical security appliances and wallet infrastructure to reduce attack surface.