Reported by 3 outlets
Bitget Critical Breach: $387.5M Stolen via Zero-Days in Security Appliances
Why this score
- Breadth
- 1.50 / 2.0 · 3 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 0.80 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.38 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.40 / 1.5 · reddit signal
- Score
- 0.4 / 10 = base × recency + community
Desk analysis
Bitget lost $387.5 million after attackers exploited zero-day vulnerabilities in two third-party security appliances to reach the exchange's wallet-signing environment, a figure revised up from the $351.6 million first disclosed on September 24 once tracing added Zcash and TRON to the original seven chains (Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC, Base). The SlowMist timeline starts on August 31, when a hidden script running under a service process on one appliance node read an environment variable holding a database password and connected to that database, with similar activity on two more nodes on September 23 and 25. Mandiant places privileged access to both appliances on September 24, followed by a web shell on appliance B, a C2 channel, lateral movement to the production wallet job server, and a custom withdrawal tool. The transfers ran from 02:31 to 05:23 UTC+8 on September 25, CEO Gracy Chen attributes the operation to North Korean hackers, and as of September 30 neither vendor nor CVE has been named.
The mechanism matters more than the total: this was not key theft, it was a signing-workflow integrity failure, because the intruder used a compromised backend system to spoof transaction data and let Bitget's own authorization process release the funds. That means the attackers never needed the keys, only the authority to make the signer believe a lie, so exchanges and custodians that treat hardware custody as the control are defending the wrong asset. The dwell is the second lesson: the first recorded malicious act on August 31 was credential access from inside a security tool's own service process, which means the intrusion sat in the victim's monitoring stack for roughly three and a half weeks before a dollar moved, and the detection that finally fired was on wallet outflow, not on the appliance. Anyone running security appliances with flat network reach to money-moving infrastructure, and any backend that stores database credentials in environment variables readable by its services, is in scope, and $387.5 million drained in under three hours shows how withdrawal automation amplifies a single foothold. North Korean attribution, if it holds alongside Bybit's $1.5 billion theft in February 2025, marks this as revenue work by an actor that industrialized exchange compromise, not opportunism.
There is no vendor advisory to patch against yet, so the work is generic zero-day hygiene on appliances plus precision on the wallet path. Treat security appliances as Tier-0: management interfaces off the internet, reachable only from an admin VLAN or bastion, with appliance logs shipped to a SIEM the appliance cannot modify. Hunt for the behaviors the two reports actually describe: scripts executing under appliance service processes, processes reading environment variables that contain database credentials, database sessions sourced from appliance addresses, web shells on appliance management planes, and new packages or services on job servers that can move funds. Rotate database and service credentials reachable from appliances, since env-var-stored secrets are one code execution away from disclosure, and for money movers add out-of-band verification of withdrawal batches, dual control on job servers, and rate limits or kill switches in the withdrawal path sized against Bitget's three-hour drain. Exchanges, stablecoin issuers and bridges should watch the published attacker addresses (EVM 0x770b10b273fc44fe9197d6bf20f145c2e98463ee, XRP rwNhefsz1UQEusxhCvHip3RANinWi4CTck, ZEC t1WgMdtND8NF7NDUuYmq8MpMj1NTCXkMDVG, TRON TBWNguTTgezw9dVorX441C6nDrZpRxYwKD) and the trace.bgblockchain.xyz reporting API, with the Recovery Bounty Program paying 5 percent of funds frozen or recovered.
Two developments would change this assessment. The first is vendor identification and CVE assignment for the two appliances: when the names drop, mass scanning of every internet-facing instance of those products usually follows within days, as this same week's exploited Citrix NetScaler zero-days demonstrate, so inventory your exposure now rather than after the disclosure. The second is containment proof: whether Mandiant or SlowMist publish web shell and C2 indicators, how much of the $387.5 million the tracing dashboard shows frozen, and whether Bitget's phased withdrawal resumption (USDT on September 30, remaining assets from October 2 at 8:00 UTC) completes without renewed outflows, since any re-break would overturn the "contained" posture the company has asserted since September 25.
Timeline
-
original reporting
Bitget suffered a CRITICAL breach ($387.5M stolen) via zero-days in two 3rd-party security appliances. Hot/warm wallets for ETH, XRP, BNB, A
radar.offseq.com · 13d ago · September 30th, 2026
Bitget suffered a CRITICAL breach ($387.5M stolen) via zero-days in two 3rd-party security appliances. Hot/warm wallets for ETH, XRP, BNB, A
via Mastodon https://radar.offseq.com/threat/bitget-hacked-via-zero-day-in-third-party-security-products-58a15a40f5a661a2
-
update from bitget.com
[SECURITY NOTICE] Bitget exchange hot wallets Incident, September 24, 2026 (vendor first disclosure)
bitget.com · 19d ago · September 24th, 2026
Bitget's original security notice, timestamped 2026-09-24 21:39 on the page, reports that unauthorized transfers from hot wallets were detected at 18:31 UTC on September 24, 2026 and estimated at approximately $351.6 million. It states cold wallets remained fully secure under Bitget's three-tier wallet architecture, that only part of the hot and warm wallet layers was affected, and that the User Protection Fund holding over $464 million covers the loss. Withdrawals were suspended as a precaution and authorities and on-chain security firms were formally notified.
-
update from bleepingcomputer.com
Hackers steal $351.6 million in Bitget crypto exchange hack (first news coverage)
bleepingcomputer.com · 18d ago · September 25th, 2026
BleepingComputer's first report on the incident, published September 25, 2026 at 04:33 AM (site displays US Eastern time, 08:33 UTC), says Bitget discovered the breach Thursday evening after security systems flagged multiple unauthorized transfers and engaged Mandiant and SlowMist plus law enforcement. CEO Gracy Chen linked the theft to North Korean hackers based on IP behavior patterns and on-chain analysis, said attackers compromised a critical backend system in the wallet infrastructure to spoof transaction data and trigger the authorization process, and listed the affected chains as Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC and Base. The article predates any mention of the zero-day exploits, which were first revealed on September 30.
-
update from bitget.com
Bitget Security Latest Incident Update: Fund Tracing and Recovery Bounty Program (vendor, revised loss and attacker addresses)
bitget.com · 18d ago · September 25th, 2026
This vendor update, timestamped 2026-09-25 14:05 on the page, revises the loss to approximately $387.5 million, up from the initial $351.6 million estimate, after adding affected assets on Zcash and TRON, and confirms the underlying vulnerability had been identified and remediated with no further unauthorized transfers possible. It publishes the primary attacker-controlled receiving addresses (EVM 0x770b10b273fc44fe9197d6bf20f145c2e98463ee, XRP rwNhefsz1UQEusxhCvHip3RANinWi4CTck, ZEC t1WgMdtND8NF7NDUuYmq8MpMj1NTCXkMDVG, TRON TBWNguTTgezw9dVorX441C6nDrZpRxYwKD), a real-time tracing dashboard and API at trace.bgblockchain.xyz, and a Recovery Bounty Program paying 5 percent of funds frozen or recovered, run with Bybit's LazarusBounty as a core channel.
-
update from bleepingcomputer.com
Bitget resumes Bitcoin withdrawals after $387.5 million crypto heist
bleepingcomputer.com · 15d ago · September 28th, 2026
It details the phased resumption schedule: ETH withdrawals on September 29 at 8:00 UTC, USDT on September 30 at 8:00 UTC, and other tokens, fiat and P2P assets starting October 2 at 8:00 UTC.
-
update from bleepingcomputer.com
Bitget hacked via zero-day in third-party security products
bleepingcomputer.com · 13d ago · September 30th, 2026
Cryptocurrency exchange Bitget revealed today that attackers who stole $387.5 million last week breached its systems after exploiting a zero-day flaw in third-party security products. According to Bitget , two separate investigations by blockchain security firm SlowMist and Google Cloud's cyber-defense arm Mandiant said the threat actors accessed Bitget's wallet environment after compromising two security appliances with zero-day exploits. After the breach, the attackers dropped web shells on one of the hacked appliances and malware on the crypto exchange's production wallet job server, as well as a custom withdrawal tool used to launch the cryptocurrency theft after midnight on September 25. "The earliest malicious activity identified in the available logs dates to August 31. A service running on one of Product A's nodes was affected by a zero-day vulnerability. The attacker ran a hidden script under the service process, launched a command to read the environment variable containing the database password, and connected to the database. "Forensic findings indicate that on September 24, 2026, a threat actor gained unauthorised privileged access to Bitget's third party security appliances A and B. The threat actor deployed a web shell onto the security appliance B and established a Command-and-Control (C2) connection. Using the persistent access on security applianc
-
mentioned by www.bleepingcomputer.com
Bitget hacked via zero-day in third-party security products https:// bleepingcomputer.com/news/security/ bitget-hacked-via-zero-day-in-third
www.bleepingcomputer.com · 13d ago · September 30th, 2026