Gracy Chen (Organization): news timeline & CVEs

Bitget hacked via zero-day in third-party security products

Bitget confirms attackers stole $387.5 million using zero-days in two third-party security appliances, deploying web shells and a custom withdrawal tool against hot wallets.

Bitget says attackers stole $387.5 million after exploiting zero-day flaws in two third-party security appliances to reach its wallet environment, per separate investigations by SlowMist and Mandiant. The actor ran hidden scripts to read a database password from an environment variable, deployed a web shell on appliance B with C2, and moved laterally to the production wallet job server with malicious packages and a custom withdrawal tool. The theft spanned nearly three hours across Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC, and Base, with the earliest malicious activity dating to August 31. CEO Gracy Chen attributed the attack to North Korean hackers citing IP behavior and on-chain analysis, and Bitget launched a Recovery Bounty Program offering 5% bounties.

BleepingComputerSep 30, 11:11 UTC · 15h agoData breach in the wild 14 sources2· 1 read

Bitget Says Attacker Exploited Third-Party Security Product Flaw to Steal $388M

Bitget says attackers exploited a zero-day in an unnamed third-party security product to steal $388 million from hot and warm wallets.

Bitget disclosed that the attacker behind the $388 million theft exploited a zero-day flaw in a third-party security product to obtain high-level internal credentials. On September 24, the attacker injected fraudulent withdrawal commands into wallet backend services, starting with two small test transfers that evaded risk controls before larger transfers were executed. Cold wallets and private keys were unaffected, and Bitget's Protection Fund will cover the loss, with Bitcoin withdrawals reopening September 28. Bitget suspects the same North Korean group it previously blamed; TRM Labs found laundering overlaps with the TraderTraitor cluster, while Mandiant and SlowMist support the investigation.

The Hacker Newsupdated Sep 30, 11:11 UTC · 15h agofirst Sep 28, 17:42 UTC · 2d agoData breach in the wild 14 sources

Bitget Backend Breach Drains $387.5 Million as DPRK-Linked Launderers Expose Themselves

Attackers compromised Bitget's backend wallet infrastructure on September 24, stealing $387.5 million; ZachXBT exposed DPRK-linked launderers seeking swap help in public chats.

Bitget detected unauthorized transfers at 18:31 UTC on September 24, 2026, losing approximately $387.5 million from hot and warm wallets across XRP, ETH, USDT, ZEC, USDC, BNB, AVAX, TRX and other assets, including about 102.93 million XRP ($157.5 million) and 31,890 ETH ($85.75 million). Attackers compromised a critical backend component, spoofed transaction data, and induced the platform's authorization process to approve fraudulent transfers without stealing private keys. ZachXBT exposed Chinese illicit actors using five aliases who openly requested support for stalled XRP-to-BTC swaps in public Discord and Telegram channels; one alias also laundered funds from the $292 million Kelp DAO exploit. Bitget attributes the operation with high confidence to a DPRK-linked group; Mandiant and SlowMist are assisting and withdrawals resumed in phases from September 28.

Cyber Security Newsupdated Sep 30, 11:11 UTC · 15h agofirst Sep 28, 14:07 UTC · 2d agoData breach in the wild 14 sources

Gracy Chen

Timeline3 articles

Appears with

Bitget hacked via zero-day in third-party security products

Bitget Says Attacker Exploited Third-Party Security Product Flaw to Steal $388M

Bitget Backend Breach Drains $387.5 Million as DPRK-Linked Launderers Expose Themselves