Bitget: an attacker compromised two third-party security appliances, moved laterally to the wallet job server and stole $388M in one of 2026's largest crypto-exchange hacks
Compromised security appliances, not a key theft, gave the attacker a path to Bitget's wallet server
Analysis
Cryptocurrency exchange Bitget confirms that, at 18:31 UTC on 2026-09-24, unauthorized transfers occurred from a portion of its hot and warm wallet infrastructure across eleven blockchains: Ethereum, XRP Ledger, TRON, Arbitrum, Optimism, Base, BNB Smart Chain, Avalanche, Algorand, Celestia and Zcash (Bitget, 2026-09-27). Per Bitget's own investigation, the attacker did not steal a private key: the attacker "exploited a vulnerability in a third-party security product to obtain high-level internal credentials" and used them "to send fraudulent withdrawal commands to the wallet system", bypassing existing risk controls (Bitget, 2026-09-27). CEO Gracy Chen described the mechanism directly: "The attacker compromised a critical backend system within our wallet infrastructure, used it to spoof transaction data, and triggered our authorization process to move funds out" (The Hacker News, 2026-09-25). Bitget states private-key compromise was ruled out, cold wallets were unaffected and the underlying vulnerability was remediated; the third-party vendor was notified and the affected functionality disabled (Bitget, 2026-09-27).
Total loss is now estimated at approximately $388M across twelve wallet addresses (Bitget, 2026-09-27), up from the USD 351.6M loss Bitget first reported, the figure TRM Labs uses in its analysis (TRM Labs, 2026-09-25). Bitget says its Protection Fund covers the financial impact (Bitget, 2026-09-27), a fund Bitget sizes at USD 464 million, according to TRM Labs (TRM Labs, 2026-09-25). Customer account balances, deposits and trading were unaffected, and withdrawals, paused at detection, resumed in phases starting with Bitcoin on 2026-09-28. Bitget revoked and reissued internal login credentials, restructured access to highly sensitive systems, now requires multiple approvals for critical operations, and engaged Mandiant and SlowMist for independent forensics (Bitget, 2026-09-27).
Bitget's CEO called North Korean involvement "very likely," based on the team's preliminary investigation linking observed IP addresses to VPN services associated with a North Korean hacking group (TRM Labs, 2026-09-25). TRM Labs, an independent blockchain-forensics firm, reports multiple on-chain overlaps with wallets used to launder earlier North Korean thefts, including Bybit and AFX Bridge, through a laundering network it has not linked to any other group's thefts, so the overlaps point to TraderTraitor: "these onchain links confirm the group laundering these proceeds is the same one used by TraderTraitor in other recent hacks" (TRM Labs, 2026-09-25). TRM is explicit that this stops short of definitive attribution: "TRM has not yet definitively attributed the exploit to North Korea" and "another actor carrying out the theft remains technically possible."
Cited evidence
The latest investigation found that the attacker exploited a vulnerability in a third-party security product to obtain high-level internal credentials.
The attacker compromised a critical backend system within our wallet infrastructure, used it to spoof transaction data, and triggered our authorization process to move funds out.
these onchain links confirm the group laundering these proceeds is the same one used by TraderTraitor in other recent hacks
The threat actor deployed a web shell onto the security appliance B and established a Command-and-Control (C2) connection.
The earliest malicious activity identified in the available logs dates to August 31.
Updates2
Bitget released the independent investigation reports from Mandiant and SlowMist on 2026-09-30. Both identify the compromise of third-party security products as what enabled access to the wallet environment (Bitget, 2026-09-30). Mandiant's status report states that on 2026-09-24 the attacker "gained unauthorised privileged access to Bitget's third party security appliances A and B", deployed a web shell on appliance B, established a command-and-control connection, and used that persistent access to move laterally to Bitget's production wallet job server and deploy malicious packages (Mandiant, 2026-09-28).
The two reports date different events and label the appliances independently: Mandiant dates the attacker's privileged access to appliances A and B to 2026-09-24 (Mandiant, 2026-09-28), while SlowMist dates the earliest malicious activity in its logs, on a node of its Product A, to 2026-08-31 (SlowMist, 2026-09-29).
SlowMist dates the earliest malicious activity in the available logs to 2026-08-31: a zero-day vulnerability in a service on one of Product A's nodes let the attacker run a hidden script under the service process, read the environment variable holding the database password and connect to the database, and the same hidden-script activity appeared on two more nodes on 2026-09-23 and 2026-09-25 (UTC+8). Early on 2026-09-25 (UTC+8) the attacker entered Product B's management platform under an internal employee's identity, made three attempts to inject system commands into task parameters to write malicious files, and then submitted code through the platform's web execution endpoint, attempting to modify server configuration, write a communication relay file and upload and assemble malicious program files in batches. SlowMist also recovered, from files the attacker had deleted, a withdrawal tool built for Bitget's withdrawal logic that forged risk-control parameters and invoked the withdrawal process, and records that the attacker later tried to alter withdrawal records directly in the wallet database (SlowMist, 2026-09-29). Neither report names the appliance vendors.
For defenders, the appliance class is security and network appliances with privileged reach into a production backend, and the observable behaviour is a web shell or hidden script running under the appliance's own service process, a new outbound command-and-control connection from the appliance, and sessions from the appliance to production servers (Mandiant, 2026-09-28) (SlowMist, 2026-09-29).
Bitget says "The affected systems were isolated and the underlying vulnerability was remediated. The relevant third-party vendor was notified and the affected functionality was disabled" (Bitget, 2026-09-27). It does not say the functionality stays disabled until the vendor ships a fix. Bitget's incident page, since updated, now states without a hedge that the attacker exploited a vulnerability in a third-party security product to obtain high-level internal credentials, and that private-key compromise has been ruled out (Bitget, 2026-09-27).
Sources7
Revision history
- Published 2026-09-29T0405Z-intel
- Update 2026-09-30T0639Z-audit
Mandiant's and SlowMist's investigation reports, released by Bitget on 2026-09-30, trace the intrusion through two compromised third-party security appliances: SlowMist dates malicious activity on a node of its Product A, attacked through a zero-day, to 2026-08-31, and Mandiant reports a web shell and command-and-control on its appliance B, then lateral movement to the production wallet job server and a custom withdrawal tool that forged risk-control parameters. Priority moves from high to notable: the appliance path is a transferable technique worth a hunt, but the vendors are unnamed and there is no product-specific decision for Swiss public bodies. TRM Labs' attribution reasoning is stated as TRM reports it, and the earlier USD 351.6M loss and the USD 464M fund size are Bitget's own figures as TRM relays them.
Changed: priority updated_at title headline summary techniques sources evidence sourcing_note body
- Correction 2026-10-11T1307Z-audit
The analysis said the affected functionality was disabled pending a fix; Bitget's incident page says the underlying vulnerability was remediated, the vendor notified and the affected functionality disabled. The sentence now follows Bitget's own wording and carries its citation. The quotations of Bitget's investigation follow the incident page's current, updated wording, which states the third-party product exploitation without the earlier hedge.
Changed: body evidence
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.