Bitget Says Zero-Days in Third-Party Security Appliances Led to $387.5 Million Theft
Summary
Bitget says attackers exploited zero-day flaws in third-party security appliances, moved laterally into its wallet infrastructure, and stole $387.5 million. Investigators found web shells and malicious packages; the exchange launched a recovery bounty program.
Key points
- Bitget says attackers exploited zero-day flaws in two third-party security appliances to gain access to its systems.
- Investigators from SlowMist and Mandiant reported web shells, a command-and-control connection, and malicious packages on compromised systems.
- Attackers moved laterally to Bitget’s production wallet job server and used a custom withdrawal tool.
- Unauthorized transfers from hot and warm wallets stole $387.5 million across multiple blockchains.
- Bitget suspended withdrawals after detecting the transfers; the article does not identify the affected security products or flaw details.
- Bitget blamed North Korean hackers, while investigators described the actor as suspected; the exchange launched a recovery bounty program.
Article Details
- Victim Organization
- Bitget
- Incident Type
- Zero-day exploitation of third-party security appliances, followed by lateral movement and theft of cryptocurrency from hot and warm wallets
- Incident Date
- 2026-09-25
- Operational Impact
- Attackers stole $387.5 million in cryptocurrency across multiple blockchains. Bitget suspended withdrawals after detecting unauthorized transfers from hot and warm wallets.
- Ransom Or Extortion
- None reported
- Claim Status
- confirmed
MITRE ATT&CK
T1021 · Remote ServicesAttackers moved laterally from security appliance B to Bitget's production wallet job server.T1059 · Command and Scripting InterpreterAttackers ran a hidden script under a service process.T1059.001 · PowerShellInvestigators described hidden-script execution, but did not specify the scripting language.T1071 · Application Layer ProtocolMandiant reported a Command-and-Control connection from security appliance B; the protocol was not specified.T1505.003 · Web ShellMandiant reported that attackers deployed a web shell on security appliance B.T1552.001 · Credentials In FilesAttackers ran a command to read an environment variable containing a database password.
People
Vendors
MandiantInvestigators from SlowMist and Mandiant linked the intrusion to persistent access, web shells, malicious packages, and a suspected North Korean threat actor.SlowMistInvestigators from SlowMist and Mandiant linked the intrusion to persistent access, web shells, malicious packages, and a suspected North Korean threat actor.