Bitget: zero-day in third-party security products led...

What happened

Bitget disclosed the theft on 24 Sep 2026 and halted withdrawals. Loss revised from about USD 351.6M to about USD 387.5M from hot and warm wallets across 11 chains, including Ethereum, XRP Ledger, Zcash and Tron (The Hacker News; Chainalysis counts 23 transfers in the first three hours).
Root cause per Bitget, Mandiant and SlowMist: “compromise of third-party security products” (unnamed, “Product A” and “Product B”). SlowMist: a zero-day in a service on a Product A node, a hidden script that read a database password from an environment variable, earliest malicious activity 31 Aug 2026. Attackers used an internal employee’s identity to reach Product B’s management platform, attempted command injection, deployed a web shell, reached the production wallet job server and ran a custom withdrawal tool that matched the wallet system’s logic. Bitget says private keys and cold wallets were not compromised.
Attribution: Bitget says IP patterns and on-chain analysis point to North Korean actors. Chainalysis calls it “DPRK-attributed” and later said Bitget proceeds commingled with Binance proceeds. Elliptic and TRM reported wallet overlaps with earlier DPRK laundering.
Response: about USD 1.1M frozen (Circle, Tether, NEAR Intents). Bitget absorbed the loss, restored its Protection Fund above USD 300M, disabled the affected vendor functionality and resumed withdrawals in phases from late Sept to 2 Oct.