Cryptocurrency exchange Bitget revealed that a recent breach resulting in the theft of $387.5 million stemmed from zero-day vulnerabilities in third-party security appliances. Findings from separate forensic investigations conducted by SlowMist and Mandiant indicate that attackers exploited these flaws to gain unauthorized privileged access to Bitget's wallet environment, ultimately enabling unauthorized fund transfers on September 25, 2026.
Exploit Path and Lateral Movement
According to Bitget and the forensic reports, threat actors compromised two distinct security appliances labeled Product A and Product B. Investigators noted malicious activity dating back to August 31, when an attacker exploited a zero-day flaw in a service process on Product A to extract database credentials. By September 24, attackers deployed a web shell on Product B to establish command-and-control access, using that foothold to move laterally into Bitget's production wallet job server.
Once inside the production environment, the attackers deployed custom malware and a withdrawal tool. This software spoofed transaction data, which tricked the exchange's internal authorization mechanisms into transferring funds out of its hot and warm crypto wallets across several blockchain networks.
Extent of the Breach and Initial Response
The unauthorized transfers occurred early on September 25, spanning roughly three hours from 02:31 to 05:23 UTC+8. The theft impacted assets on multiple networks including Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC, and Base, affecting tokens such as ETH, XRP, BNB, AVAX, USDT, and USDC.
Bitget temporarily suspended all withdrawals after detecting the abnormal transfers. CEO Gracy Chen attributed the attack to North Korean state-sponsored threat actors based on IP behavior and on-chain analysis. To assist with asset retrieval, Bitget introduced a Recovery Bounty Program offering 5% of recovered assets to parties who assist in freezing or recovering the stolen cryptocurrency.
AI-generated editorial illustration; not a documentary photograph.
Source: Bitget hacked via zero-day in third-party security products
SIGNAL TITANS
Leave a Reply