Bitget on Wednesday confirmed that a third-party security-product zero-day was the entry point for the $387.5 million theft from its hot and warm wallets. The exchange said SlowMist’s investigation also recovered a custom tool used to trigger the unauthorized withdrawals, and that the operation has been linked to North Korean actors.
The flaw mattered because it sat inside trusted infrastructure. Bitget said the attackers used it to obtain high-level internal credentials, move laterally into wallet systems, and issue withdrawal commands that its risk controls treated as legitimate. SlowMist said the earliest malicious activity dates to August 31, showing the compromise was already inside the environment before the transfers began.
For exchange operators, the lasting risk is not limited to wallet keys. When a security tool sits in the production trust path, compromising it can turn internal authorization into the attack surface and make fraudulent transfers look like routine operations until the tool itself is removed from trust.
Bitget hacked via zero-day in third-party security products
Cryptocurrency exchange Bitget revealed today that attackers who stole $387.5 million last week breached its systems after exploiting a zero-day flaw in third-party security products.