Bitget confirms a third-party zero-day behind the $387.5 million theft
The exchange confirmed that the attack on its wallet system went through third-party security products. What is known, and what it means for companies.
On 24 September 2026 the exchange Bitget announced a theft of $387.5 million from its hot and warm wallets and temporarily suspended withdrawals. On 30 September the company stated that the attackers exploited a zero-day vulnerability in third-party security products. Here are the known facts, with a note on who stated them.
What happened
According to the account published by The Hacker News on 1 October 2026, the unauthorised transfers affected 11 blockchains, including Ethereum, XRP Ledger, TRON, Arbitrum, Base and BNB Smart Chain. The assets involved include XRP, ETH, USDT, USDC, BNB and other tokens. So far about $1.1 million has been frozen, by Circle, Tether and NEAR Intents: a very small fraction of the total.
How the attack worked
Bitget explained that the attackers obtained high-level internal credentials and used them to issue fraudulent withdrawal commands to the wallet system, bypassing existing risk controls. The investigations by SlowMist and Mandiant, quoted in the article, describe a multi-step chain: access to two third-party security appliances (labelled A and B), installation of a web shell on one of them, lateral movement to the server that handles withdrawals, and deployment of malicious packages. SlowMist places the earliest malicious activity on 31 August 2026; the withdrawal tool started running on 25 September at 01:49. Bitget notified the vendor and disabled the affected function pending a fix.
Who is behind it, according to Bitget
Bitget attributes the attack to North Korean actors, based on IP behaviour patterns and on-chain analysis. The analysts Elliptic and TRM Labs found overlaps between the wallets used to launder the funds and those of earlier attacks. This is an attribution stated by the company, not a judicial finding.
What is not known
The cited article does not report on reimbursement of users or on the recovery of the stolen funds, and this article does not speculate on either. Investigations are described as ongoing, and the figures may be revised. For readers who hold assets on any exchange, the practical point is to follow the platform's official communications and to avoid unsolicited messages offering recovery services, which are a common follow-up scam.
Why it matters to Swiss businesses
The incident does not stem from a flaw in the blockchain, but from technical dependencies: security products installed inside the infrastructure. Any company that uses appliances, agents or services from third parties has the same kind of exposure. A few practical questions, valid outside the crypto sector as well:
- Which third-party components have privileged access to our critical systems?
- Are internal credentials segmented, rotated and monitored?
- Can a single administrative command move value without a second approval?
- Is there a response plan, with vendor and forensic contacts?
For anyone who runs even just a website, a management system or a customer portal, the principle is the same: reduce privileges, separate roles and check access.
Sources
- The Hacker News, Bitget Confirms Third-Party Zero-Day Behind $387.5 Million Cryptocurrency Theft, 1 October 2026: https://thehackernews.com/2026/10/bitget-confirms-third-party-zero-day.html
Information, not advice. Figures and attributions are those stated by the cited sources.
