Bitget Confirms Third-Party Zero-Day Exploit Led to $387.5 Million Crypto Theft Across 11 Blockchains

New York, October 5 — Bitget, the cryptocurrency trading platform, disclosed a staggering theft of $387.5 million from its hot and warm wallets on September 24, 2026. The exchange temporarily halted all withdrawals in response. On Wednesday, September 25, 2026, Bitget confirmed that the attackers had exploited a zero-day vulnerability in third-party security products, as identified in an ongoing investigation by blockchain security firm SlowMist. SlowMist’s analysis revealed that the malicious activity began as early as August 31, 2026, when a service running on one of Product A’s nodes was compromised via a zero-day vulnerability. The attacker then ran a hidden script under the service process to read environment variables containing database passwords and connect to the database. Similar hidden-script activity was observed on two other nodes on September 23 and September 25, 2026, indicating the environment was compromised prior to asset transfers. On September 25, 2026, the threat actor accessed Product B’s management platform using an internal employee’s identity, making three consecutive attempts to inject system commands into task parameters to write malicious files. The attacker then submitted code through the platform’s web execution endpoint to modify server configuration, write a communication relay file, and upload and assemble malicious program files in batches. SlowMist recovered a bespoke tool among deleted files, highly tailored to Bitget’s wallet system withdrawal logic, which began executing cryptocurrency theft at 01:49 a.m. on September 25, 2026. The tool enabled attackers to obtain high-level internal credentials and issue fraudulent withdrawal commands that bypassed existing risk controls. Mandiant’s probe confirmed attackers gained unauthorized access to third-party security appliances (Products A and B), deployed a web shell on security appliance B, established a Command-and-Control (C2) connection, and used persistent access to move laterally into Bitget’s production wallet job server, where they deployed malicious packages to distribute malware and gain control over wallet operations. Bitget reported that close to $1.1 million in cryptocurrency assets have been frozen by Circle, Tether, and NEAR Intents. The incident impacted 11 blockchains: Ethereum, XRP Ledger, Zcash, TRON, Arbitrum, Optimism, Base, BNB Smart Chain, Avalanche, Algorand, and Celestia. Affected assets include XRP, ETH, USDT, ZEC, ATOM, USDC, USD0, XAUt, BNB, AVAX, TRX, ALGO, and TIA. Bitget has notified the relevant third-party vendor and disabled the affected functionality pending a fix. The company stated that IP behavior patterns and on-chain analysis indicate the attack was carried out by North Korean threat actors, with Elliptic and TRM Labs identifying wallet overlaps used to launder proceeds from previous hacks. Bitget has not disclosed the identity of the third-party vendor involved. Looking ahead, the industry awaits Bitget’s recovery efforts and the results of their ongoing investigations. The incident underscores the need for robust security measures in the rapidly evolving world of cryptocurrency trading.

Sources

• Bitget — Wikipedia