Bitget confirms zero-day link to $387.5 million theft

Bitget said on 24 September 2026 that attackers had removed $387.5 million from its hot and warm wallets through unauthorised transfers, and it suspended withdrawals while it investigated. It later said Circle, Tether and NEAR Intents had frozen about $1.1 million in cryptocurrency assets.

The exchange said SlowMist's findings showed that a zero-day in third-party security products had let the attackers obtain elevated internal access and issue false withdrawal instructions. Bitget said it had notified the vendor involved and disabled the affected function while a fix was completed.

SlowMist said the first malicious activity it linked to the case dated to 31 August 2026. It said a service on one node of Product A was hit by the flaw, after which the attacker ran a hidden script, read an environment variable holding a database password and connected to the database.

SlowMist also said that on 25 September the attacker used an employee identity to reach Product B's management platform and made three attempts to inject commands into task parameters. It said the attacker then used the platform's web execution endpoint to alter server settings, create a relay file and upload malicious files in batches.

The firm said it recovered a bespoke theft tool from deleted files and that the program began running at 01:49 a.m. on 25 September 2026. Mandiant separately said the attackers had entered third-party security appliances, placed a web shell on one of them and used that foothold to reach Bitget's production wallet job server, while Bitget said its own analysis pointed to North Korean threat actors.