Bitget's $387.5 million theft began with zero-days in two of its security appliances
Bitget says attackers stole $387.5 million after exploiting zero-days in two third-party security appliances. Investigators say the appliances' privileged access led the attacker to its production wallet server.
The Watch · Security desk
What happened
- A custom withdrawal tool the attackers placed on Bitget's systems launched the theft after midnight on September 25.
- SlowMist timed the first theft transfer at 02:31 UTC+8 and the last at 05:23, a run of nearly three hours across several blockchains.
- Stolen assets included ETH, XRP, BNB, AVAX, USDT and USDC, moved on chains including Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC and Base.
- CEO Gracy Chen blamed North Korean hackers, citing IP behavior patterns and on-chain analysis.
- Bitget has opened a Recovery Bounty Program paying 5% to anyone who helps recover or freeze the stolen funds.
Why it matters
- Who's exposed exposure Other operators of the same two appliances cannot check for this entry point until Bitget, its investigators or the vendors name the products and the flaws.
- What it limits constraint On Chen's account, approval checks further down the chain cannot catch a withdrawal forged in the backend system that feeds them data.
- Who has to decide decision Exchanges running security appliances that hold database credentials or can reach wallet servers now have to decide whether to patch and monitor them as closely as the wallet servers.
- What it costs cost If the bounty program recovered the whole sum, Bitget would pay out about $19.4 million.
On SlowMist's account, the first foothold was a service on a Product A node hit by a zero-day [4]. The attacker "ran a hidden script under the service process, launched a command to read the environment variable containing the database password, and connected to the database," SlowMist said [4]. The same hidden-script activity appeared on two more nodes on September 23 and September 25 [15].
Appliance B was the route to the wallets. The attacker planted a web shell on it and opened a Command-and-Control connection, according to Mandiant [7]. "Using the persistent access on security appliance B, the threat actor moved laterally to Bitget's production wallet job server and deployed malicious packages," Mandiant said [7]. Chief executive Gracy Chen said the attackers breached a critical backend system in the wallet infrastructure and used it to spoof transaction data [12]. The spoofed data triggered Bitget's own authorization process to move funds out of the compromised wallets [12].
The two firms date the intrusion differently. SlowMist's earliest entry in the available logs is August 31 [5]. Mandiant puts the privileged access to appliances A and B on September 24, 2026 [6]. The two dates are 24 days apart [17]. The excerpts identify the products only as "Product A" and "appliances A and B" [4][6]. If SlowMist's date is right, the attacker was active on a Product A node 25 days before the theft began [18].
Mandiant's published excerpt calls the intruder "a threat actor" and does not name a country [6]. According to BleepingComputer, North Korean hackers were behind the Bybit theft, which took $1.5 billion from that exchange's ETH cold wallet [16]. Bitget's losses came from hot and warm wallets [9].
A Bitget spokesperson was not immediately available when BleepingComputer asked for more on the zero-day and the affected products [14].
What to watch
- Disclosure of the two appliance vendors and the zero-day flaws by Bitget, SlowMist, Mandiant or the vendors themselves.
- A reconciled timeline from SlowMist and Mandiant on when the attacker first reached the appliances.
- Amounts frozen or recovered under the bounty program, and whether any investigator beyond Chen backs the North Korea attribution.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+10
- Incentives60
- Confidence60
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Bitget said attackers who stole $387.5 million last week breached its systems after exploiting a zero-day flaw in third-party security products.
- [2]
According to Bitget, separate investigations by SlowMist and Mandiant found the threat actors accessed Bitget's wallet environment after compromising two security appliances with zero-day exploits.
- [3]
After the breach, the attackers dropped web shells on one of the hacked appliances, malware on the production wallet job server, and a custom withdrawal tool used to launch the theft after midnight on September 25.
- [4]
"A service running on one of Product A's nodes was affected by a zero-day vulnerability. The attacker ran a hidden script under the service process, launched a command to read the environment variable containing the database password, and connected to the database."
- [5]
"The earliest malicious activity identified in the available logs dates to August 31."
- [6]
"Forensic findings indicate that on September 24, 2026, a threat actor gained unauthorised privileged access to Bitget's third party security appliances A and B."
- [7]
"The threat actor deployed a web shell onto the security appliance B and established a Command-and-Control (C2) connection. Using the persistent access on security appliance B, the threat actor moved laterally to Bitget's production wallet job server and deployed malicious packages."
- [8]
The earliest theft transfer occurred at 02:31 (UTC+8) and the last at 05:23, with the attack spanning nearly three hours across multiple blockchains.
- [9]
Bitget suspended all withdrawals after detecting multiple unauthorized transfers from its hot and warm crypto wallets.
- [10]
The incident affected assets including ETH, XRP, BNB, AVAX, USDT, USDC and other tokens, on the Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC and Base chains.
- [11]
Gracy Chen blamed the attack on North Korean hackers, citing IP behavior patterns and on-chain analysis as evidence.
- [12]
The attackers breached a critical backend system within Bitget's wallet infrastructure that was later used to spoof transaction data, triggering the exchange's authorization process to move funds out of compromised hot/warm wallets.
- [13]
Bitget launched a Recovery Bounty Program offering bounties of 5% to those who help recover or freeze funds stolen in the attack.
- [14]
A Bitget spokesperson was not immediately available when BleepingComputer asked for more information on the zero-day flaw and the third-party security products compromised in the attack.
- [15]
"Similar hidden-script activity was observed on two other nodes on September 23 and September 25."
- [16]
North Korean hackers were behind the Bybit hack, in which they stole $1.5 billion from the exchange's ETH cold wallet.
- [17]
SlowMist's earliest logged malicious activity (August 31) and Mandiant's privileged-access date (September 24) are 24 days apart.
- [18]
SlowMist's earliest logged activity on August 31 came 25 days before the theft launched on September 25.
- [19]
A 5% bounty on the full $387.5 million would pay out about $19.4 million.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
2 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comBitget hacked via zero-day in third-party security products
1 article · September 30, 2026
- thehackernews.comBitget Confirms Third-Party Zero-Day Behind $387.5 Million Cryptocurrency Theft
2 articles · October 1, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Zero-Day VulnerabilitiesFollow
- Cryptocurrency exchange breachesFollow
- Security Appliance CompromiseFollow
- North Korean state hackingFollow