← News
/DISPATCH · 2026-09-29

Bitget Loses About $388 Million After Third-Party Security Product Zero-Day

Cryptocurrency exchange Bitget said an attacker used a zero-day in an unnamed third-party security product to obtain high-privilege internal credentials and steal about $388 million (about 2.601 billion yuan) on September 24. Customer balances and private keys were reported unaffected; the exchange will cover the loss from a protection fund and has restricted internal access while reviewing third-

Anquan Neican reported on September 29, 2026, that international cryptocurrency exchange Bitget said an attacker used a vulnerability in a third-party security product the exchange had purchased, gained system access, and stole about $388 million (about 2.601 billion yuan).

Bitget said the attacker used the flaw to obtain high-privilege internal credentials and, on September 24, sent false withdrawal instructions to Bitget wallet systems.

Cryptocurrency exchanges typically keep most customer funds in offline cold wallets and use hot and warm wallets for withdrawals. Transfers still require approval before signing. Stolen funds came from some Bitget hot and warm wallets. Cold wallets were not affected.

Forged withdrawal instructions on internal systems

Bitget had previously said a critical backend system in its wallet infrastructure was compromised. The attacker used that system to forge transaction data and trigger wallet approval. At that time Bitget did not say how the attacker entered.

Chief executive Gracy Chen described the sequence in a Monday livestream interview. She said the vulnerability gave access to an internal management system. The attacker then planted false withdrawal instructions on wallet-related backend services, which the system executed as normal operations.

On September 24, the attacker first initiated two small test transfers at 18:31 UTC. Because the amounts were below Bitget's risk-control threshold, those transactions did not raise alerts.

About 30 minutes later, the attacker began large transfers. The Bitget wallet system executed them as usual, which went around risk controls.

U.Today reported Chen as saying the attacker used legitimate credentials throughout, disguised activity as routine administration, and cleared related traces.

Bitget said the investigation so far shows no private keys were leaked.

Zero-day in a security product

The Block reported that Chen did not name the product on Monday. She described the flaw as a zero-day, meaning it was used before the vendor issued a fix.

Crypto Briefing reported that Bitget notified the vendor, isolated affected systems, revoked and reissued internal credentials, and disabled affected functions while the flaw was being fixed. Bitget has not said whether the vendor has released a patch.

The sequence above is Bitget's account. Mandiant and SlowMist are assisting the investigation. Bitget expects to publish a formal incident report this week.

Bitget has further restricted internal access, added independent checks at withdrawal, and increased monitoring of abnormal activity. The exchange also plans to re-examine evaluation and deployment of third-party security products.

Bitget said customer account balances were not affected. The loss will be covered by a protection fund reserved for such incidents.

Bitcoin withdrawals resumed Monday. Withdrawals of other assets are scheduled to resume in stages by October 2. Users need not take any action.

Suspected North Korean involvement

Bitget last week attributed the attack to North Korean hackers. Chen told The Block the company still suspects "the same group of people" but declined to name a group before the formal report.

Blockchain analytics firm TRM Labs said last week that stolen funds linked to wallets previously used to launder proceeds of North Korean thefts. Those links point toward the North Korean group TraderTraitor. TRM Labs has not made a definitive attribution.

Bitget published primary wallet addresses that received stolen funds and launched a live tracking dashboard. The exchange asked other exchanges, stablecoin issuers, cross-chain bridges, custodians, and other infrastructure providers to watch those addresses and report leads through its recovery platform.

Addresses published by Bitget on September 25:

TRM Labs advised exchanges screening deposits to follow funds that passed through intermediate wallets originating from those addresses, not only direct transfers. Stolen funds are moving through cross-chain bridges and swap services, so they are more likely to arrive indirectly.

Reference: https://thehackernews.com/2026/09/bitget-says-attacker-exploited-third.html