Bitget's $387.5M Theft Traced to Zero-Day Exploits in Third-Party Security Tools

Bitget disclosed that a $387.5 million theft from its cryptocurrency wallets last week resulted from attackers exploiting zero-day flaws in third-party security products. Forensic work by blockchain security firm SlowMist and Mandiant, Google Cloud's threat intelligence division, revealed that threat actors used these vulnerabilities to gain entry into Bitget's wallet infrastructure.

The attackers compromised two security appliances using zero-day exploits, then deployed web shells and malware to establish persistence and move laterally through the exchange's systems. On September 25, after midnight, they executed a coordinated theft using a custom withdrawal tool to move cryptocurrency across multiple blockchains.

Timeline and Technical Details

SlowMist's investigation identified the earliest malicious activity on August 31, when a service running on one of the compromised appliances was exploited. The attackers executed hidden scripts under the service process to extract database credentials and establish database access. Similar hidden-script activity appeared on two additional nodes on September 23 and September 25.

The earliest malicious activity identified in the available logs dates to August 31. A service running on one of Product A's nodes was affected by a zero-day vulnerability. The attacker ran a hidden script under the service process, launched a command to read the environment variable containing the database password, and connected to the database. Similar hidden-script activity was observed on two other nodes on September 23 and September 25.

SlowMist

Mandiant's findings documented that on September 24, 2026, unauthorized privileged access was obtained to both security appliances. A web shell was deployed on one appliance to establish command-and-control connectivity, which then served as a pivot point for lateral movement to Bitget's production wallet job server, where malicious packages were installed.

Forensic findings indicate that on September 24, 2026, a threat actor gained unauthorised privileged access to Bitget's third party security appliances A and B. The threat actor deployed a web shell onto the security appliance B and established a Command-and-Control (C2) connection. Using the persistent access on security appliance B, the threat actor moved laterally to Bitget's production wallet job server and deployed malicious packages.

Mandiant

The theft itself occurred over a compressed timeframe, with the earliest transfer at 02:31 UTC+8 on September 25 and the final transfer at 05:23, spanning nearly three hours across multiple blockchain networks.

Assets and Attribution

Bitget suspended all withdrawals after detecting unauthorized transfers from its hot and warm wallets. CEO Gracy Chen confirmed the incident affected multiple token types and blockchain networks.

The stolen assets included ETH, XRP, BNB, AVAX, USDT, USDC, and other tokens across the Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC, and Base chains.

Chen attributed the attack to North Korean threat actors based on IP behavior patterns and on-chain analysis. According to the CEO, the attackers compromised a critical backend system within Bitget's wallet infrastructure that enabled them to spoof transaction data and bypass the exchange's authorization mechanisms, allowing funds to be withdrawn from the compromised hot and warm wallets.

North Korean-linked groups have been responsible for numerous major cryptocurrency thefts. The Bybit exchange breach, attributed to the same threat actors, resulted in the theft of $1.5 billion in ETH from the platform's cold storage.

Recovery Efforts

Bitget has established a Recovery Bounty Program offering bounties of 5% to individuals who assist in recovering or freezing the stolen funds.

Bitget did not immediately provide additional details regarding the specific zero-day vulnerabilities or the identities of the compromised third-party security products when contacted for comment.