Bitget Confirms Third-Party Zero-Day Behind $387.5 Million Cryptocurrency Theft
Summary: Bitget confirmed that attackers stole $387.5 million from its hot and warm wallets through unauthorized transfers, exploiting a zero-day in third-party security products to obtain high-level internal credentials and issue fraudulent withdrawal commands that bypassed existing risk controls. SlowMist traced the earliest malicious activity to August 31, 2026, and Mandiant found the attackers deployed a web shell on security appliance B, established a C2 connection, and moved laterally to Bitget's production wallet job server, with Bitget attributing the attack to North Korean threat actors based on IP behavior and on-chain analysis.
Why it matters: The entry point was the security tooling itself: attackers turned compromised network and security appliances into the path to the wallet job server, and only about $1.1 million of the $387.5 million has been frozen by Circle, Tether, and NEAR Intents.
Read the original at The Hacker News ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026