Bitget Says Attacker Exploited Third-Party Security Product Flaw to Steal $388M
Summary: Bitget says an attacker exploited a vulnerability in a third-party security product to obtain high-level internal credentials, then on September 24 used them to send fraudulent withdrawal commands into its wallet backend, stealing about $388 million from hot and warm wallets while cold wallets were unaffected. The attacker made two small test transfers at 18:31 UTC that stayed below Bitget's risk-control threshold, then began larger transfers about 30 minutes later that the wallet system executed while bypassing its controls; Bitget says no private keys were compromised and that Mandiant and SlowMist are supporting its investigation.
Bottom line: The entry point was a security product Bitget deployed to protect itself, and the fraudulent commands were treated as legitimate because they carried real credentials disguised as routine administrative operations. Bitget still suspects the same North Korean group it pointed to last week, and TRM Labs found overlaps between the stolen funds and wallets used to launder earlier North Korean thefts.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026