Vulnerabilities · 43 days ago
Bitget on Wednesday confirmed that a third-party security-product zero-day was the entry point for the $387.5 million theft from its hot and warm wallets. The exchange said SlowMist’s investigation also recovered a custom tool used to trigger the unauthorized withdrawals, and that the operation has been linked to North Korean actors.
The flaw mattered because it sat inside trusted infrastructure. Bitget said the attackers used it to obtain high-level internal credentials, move laterally into wallet systems, and issue withdrawal commands that its risk controls treated as legitimate. SlowMist said the earliest malicious activity dates to August 31, showing the compromise was already inside the environment before the transfers began.
For exchange operators, the lasting risk is not limited to wallet keys. When a security tool sits in the production trust path, compromising it can turn internal authorization into the attack surface and make fraudulent transfers look like routine operations until the tool itself is removed from trust.
3 sources covering this story
Bitget Confirms Third-Party Zero-Day Behind $387.5 Million Cryptocurrency Theft
Bitget says attackers exploited a third-party zero-day to steal $387.5 million and move laterally into its wallet environment.
Bitget hacked via zero-day in third-party security products
Cryptocurrency exchange Bitget revealed today that attackers who stole $387.5 million last week breached its systems after exploiting a zero-day flaw in third-party security products.
Bitget Says Attacker Exploited Third-Party Security Product Flaw to Steal $388M
Bitget says an attacker used a third-party security product flaw to steal internal credentials and trigger about $388M in fraudulent withdrawals.
Bitget Restarts Bitcoin Withdrawals Following $387.5m Wallet Breach
Bitget has restarted Bitcoin withdrawals after a $387.5m breach of its hot and warm wallets
Part of the PlainSec briefing for 2026-10-01