Bitget Confirms Zero-Day in Security Appliances Enabled $387.5 Million Heist
Cryptocurrency exchange Bitget revealed today that the attackers who stole $387.5 million from the platform last week breached its systems after exploiting a zero-day vulnerability in third-party security products. According to Bitget's incident disclosure, the intrusion began with a flaw in a security vendor's appliance — referred to in forensic reporting only as "Product A" — that gave attackers an initial foothold nearly a month before the theft was executed. From there, the attackers escalated access, moved laterally onto Bitget's production wallet infrastructure, and drained funds across seven blockchains in a window of roughly three hours. Bitget CEO Gracy Chen has attributed the attack to North Korean hackers, citing IP behavior patterns and on-chain analysis.
Details
| Attribute | Value |
|---|---|
| Target | Bitget (cryptocurrency exchange) |
| Amount Stolen | $387.5 million |
| Root Cause | Zero-day vulnerability in third-party security appliances ("Product A", appliances A and B) |
| Initial Compromise | August 31, 2026 |
| Privileged Access Gained | September 24, 2026 |
| Theft Window | September 25, 2026, 02:31–05:23 UTC+8 (approximately 3 hours) |
| Disclosure Date | September 30, 2026 |
| Assets Stolen | ETH, XRP, BNB, AVAX, USDT, USDC, and other tokens |
| Blockchains Affected | Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC, Base |
| Attribution | North Korea-linked actors (per Bitget CEO Gracy Chen) |
| CVE Identifier | None disclosed |
| Investigators | SlowMist, Mandiant (Google Cloud) |
| Current Status | Withdrawals suspended, then partially resumed; Recovery Bounty Program active |
How It Worked
Initial Compromise
Bitget's forensic timeline shows the intrusion did not begin with the theft itself but weeks earlier. On August 31, 2026, a service running on one of "Product A's" nodes — a third-party security appliance used in Bitget's environment — was compromised through a zero-day vulnerability. The vendor and product name were not disclosed in the investigation reports. Between September 23 and 25, investigators later identified hidden script activity spreading across additional nodes, indicating the attackers had been quietly expanding their foothold for weeks before acting.
Privilege Escalation and Lateral Movement
On September 24, the threat actors obtained unauthorized privileged access to two of Bitget's third-party security appliances, identified in reporting only as "appliances A and B." With that elevated access, they deployed web shells and established command-and-control connections, then pivoted laterally from the compromised security infrastructure into Bitget's production wallet job server — the system responsible for processing withdrawal transactions.
Execution of the Theft
Early on September 25, the attackers installed malicious packages and custom withdrawal tools on the wallet server, then spoofed transaction data to bypass Bitget's authorization controls. Using this access, they executed unauthorized withdrawals between 02:31 and 05:23 UTC+8, moving $387.5 million in cryptocurrency — including ETH, XRP, BNB, AVAX, USDT, and USDC — across the Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC, and Base networks before the activity was detected and withdrawals were suspended.
Attribution
Bitget CEO Gracy Chen publicly attributed the attack to North Korean state-linked hackers, pointing to IP address behavior patterns and on-chain fund-movement analysis consistent with previously documented DPRK-affiliated crypto-theft operations. Blockchain forensics firm SlowMist conducted on-chain analysis of the stolen funds, while Mandiant, Google Cloud's incident response division, was brought in to confirm the technical attack vector described above.
Impact Assessment
| Impact Area | Description |
|---|---|
| Financial Loss | $387.5 million in cryptocurrency stolen in a single ~3-hour window |
| Third-Party Risk | A zero-day in security software Bitget relied on for protection became the attacker's entry point — turning a defensive control into an attack surface |
| Dwell Time | Nearly a month elapsed between initial compromise (August 31) and the theft (September 25), with lateral movement activity visible days before execution |
| Operational Disruption | Bitget suspended all withdrawals platform-wide upon discovery, affecting every user, not just those directly targeted |
| Multi-Chain Exposure | Funds were drained across seven separate blockchain networks, reflecting the breadth of access the attackers achieved on the wallet infrastructure |
| Industry Confidence | Adds to a string of large-scale exchange breaches in 2026, reinforcing scrutiny of exchange custody architecture and vendor security dependencies |
Recommendations
For Exchange and Custody Operators
- Treat every third-party security appliance as part of your attack surface, not purely a defensive layer — apply the same patching urgency, network segmentation, and monitoring to security products as to production systems.
- Segment wallet job servers and withdrawal infrastructure from general corporate and security-appliance networks so a compromise of one does not provide a direct path to the other.
- Deploy transaction-integrity verification that is independent of the systems being used to authorize withdrawals, so spoofed transaction data cannot bypass approval without an out-of-band check.
- Hunt for web shells and unexpected outbound connections on security appliances and management infrastructure, not just customer-facing systems.
For Security Teams
- Monitor vendor security advisories and threat intelligence closely for the specific security products deployed in your environment, since zero-days in defensive tooling are increasingly a preferred initial-access vector.
- Shorten detection timelines for lateral movement — in this incident, nearly a month passed between initial compromise and the theft, time during which earlier detection could have prevented the loss entirely.
- Maintain tested incident response relationships with blockchain forensics and third-party IR firms (as Bitget did with SlowMist and Mandiant) to accelerate root-cause confirmation after a breach.
For Cryptocurrency Users
- Avoid keeping large balances on any single exchange, regardless of its security reputation — distribute holdings across custody methods, including self-custody where appropriate.
- Follow official exchange channels for withdrawal status updates after a disclosed breach rather than relying on third-party speculation.
- Review any exchange's incident disclosure and bounty programs when evaluating counterparty risk; Bitget's Recovery Bounty Program offers a 5% reward for assistance recovering stolen funds.
Key Takeaways
- Bitget lost $387.5 million after attackers exploited a zero-day vulnerability in third-party security appliances, not a flaw in Bitget's own application code.
- The intrusion began nearly a month before the theft, with initial compromise on August 31 and the actual withdrawal theft executed on September 25 between 02:31 and 05:23 UTC+8.
- Attackers used web shells, command-and-control connections, and spoofed transaction data to move from compromised security infrastructure to Bitget's production wallet server.
- Stolen funds spanned ETH, XRP, BNB, AVAX, USDT, and USDC across seven blockchains, reflecting broad access to withdrawal processing.
- Bitget CEO Gracy Chen attributed the attack to North Korean hackers, consistent with the group's established track record of targeting cryptocurrency exchanges.
- The incident underscores a growing trend: defensive security products themselves are becoming high-value zero-day targets, since compromising them can grant privileged access to the very systems they're meant to protect.