Bitget Confirms Third-Party Zero-Day Behind $387.5 Million Cryptocurrency Theft
Bitget confirms North Korean-linked attackers stole $387.5M via a zero-day in third-party security appliances, deploying web shells and a custom withdrawal tool.
Bitget confirmed attackers stole $387.5 million from its hot and warm wallets on September 25, 2026, exploiting a zero-day in third-party security products to obtain high-level internal credentials and issue fraudulent withdrawals bypassing risk controls across 11 blockchains including Ethereum, TRON, and XRP Ledger. SlowMist traced hidden scripts reading database password environment variables to August 31, and Mandiant found a web shell on security appliance B used for C2 and lateral movement into Bitget's production wallet job server. A bespoke tool tailored to the wallet system's withdrawal logic executed the theft at 01:49 on September 25. Around $632,700 has been frozen by Circle, Tether, and NEAR Intents, and Bitget attributes the attack to North Korean actors based on IP patterns and wallet overlaps identified by Elliptic and TRM Labs.
- $387.5M drained from hot and warm wallets across 11 blockchains including Ethereum, TRON, XRP Ledger
- Zero-day in third-party security appliances yielded internal credentials and bypassed withdrawal risk controls
- Mandiant: web shell on appliance enabled C2 and lateral movement to production wallet job server
- Earliest malicious activity August 31; custom theft tool ran September 25 at 01:49
- About $632,700 frozen by Circle, Tether, NEAR Intents; on-chain analysis links actors to North Korea
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1505.003 Server Software Component: Web ShellT1078 Valid AccountsT1552.001 Unsecured Credentials: Credentials In Files
From the original article
3 min read at thehackernews.com
Cryptocurrency exchange Bitget on Wednesday confirmed that attackers who stole $387. 5 million last week exploited a zero-day flaw in third-party security products, citing ongoing investigation findings from SlowMist. "Their investigation identified malicious activity involving third-party security products, including a zero-day vulnerability, and recovered a customized tool used by the attacker
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.