Bitget ties $387.5 million theft to zero-day breach

Bitget said attackers stole $387.5 million after exploiting a zero-day flaw in third-party security products. SlowMist and Mandiant carried out separate investigations and both said the attackers reached Bitget's wallet environment through compromised security appliances.

SlowMist said the earliest malicious activity in the available logs dated to August 31. It said a service on one node ran a hidden script, read a database password variable and connected to the database, with similar activity later seen on September 23 and September 25.

Mandiant said a threat actor obtained privileged access to two security appliances on September 24, 2026. It said the actor placed a web shell on one appliance, opened a command-and-control connection and later reached Bitget's production wallet job server.

SlowMist said the first transfer linked to the theft happened at 02:31 UTC+8 on September 25 and the last at 05:23, across nearly three hours and multiple blockchains. Bitget suspended withdrawals after finding unauthorised transfers from hot and warm wallets and said the loss totalled $387.5 million.

Chen said the incident affected ETH, XRP, BNB, AVAX, USDT, USDC and other tokens across Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC and Base. She blamed North Korean hackers and said a backend system had been used to spoof transaction data, and Bitget launched a Recovery Bounty Program offering 5% for help recovering or freezing funds.