Bitget Says a Third-Party Zero-Day Let Suspected North Korean Hackers Steal $387.5 Million
Cryptocurrency exchange Bitget has confirmed that a security breach resulted in the theft of $387.5 million from its hot and warm wallets, pointing to a zero-day vulnerability in third-party security software as the initial point of entry. The fraudulent transfers were discovered on September 24 and 25, 2026, though forensic investigators say the intrusion began weeks earlier.
Bitget Confirms $387.5 Million Breach Tied to Third-Party Zero-Day
Bitget says attackers exploited a previously unknown vulnerability in third-party security appliances used within its infrastructure to gain initial access. The company has not publicly named the specific zero-day or the affected vendor products, leaving some technical details of the intrusion undisclosed. What is confirmed is the scale of the loss: $387.5 million in digital assets drained from wallets that Bitget uses for operational liquidity.
Timeline: Weeks of Undetected Lateral Movement
Forensic investigations conducted by security firms SlowMist and Mandiant, commissioned by Bitget, trace the earliest signs of malicious activity to August 31, 2026, roughly three and a half weeks before the theft was executed. During this window, investigators say attackers deployed a web shell on a compromised security appliance and established a command-and-control connection, allowing them to maintain persistent access while quietly moving through Bitget's internal systems.
This extended dwell time is notable because it suggests the intrusion went undetected for an extended period, giving attackers time to study internal systems and prepare for the eventual withdrawal of funds rather than executing a smash-and-grab operation.
How the Heist Was Executed
Investigators reported that the attackers ultimately compromised internal employee credentials, which were used to access an administrative management platform and bypass risk controls that would normally flag suspicious withdrawal activity. From there, a custom tool reportedly built specifically around Bitget's withdrawal logic was used to siphon funds in a way designed to blend in with legitimate transaction patterns.
The fraudulent transfers spanned eleven blockchains, including Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BNB Smart Chain, and Base, reflecting the multi-chain nature of modern exchange operations and the scope of systems the attackers were able to reach.
North Korea Attribution: What's Confirmed and What's Alleged
Bitget's CEO has attributed the attack to North Korean hackers, citing IP behavior patterns and on-chain analysis as supporting evidence. Blockchain analytics firms Elliptic and TRM Labs reportedly identified overlaps between wallets used in this incident and those linked to prior North Korea-connected heists, including the large-scale theft from exchange Bybit.
It is important to note that this attribution currently rests on company-commissioned forensic work and statements from Bitget's own leadership rather than confirmation from independent law enforcement or government agencies. Many observers in the security community note that North Korea-linked groups have a well-documented history of targeting cryptocurrency infrastructure, which lends some context to the claim, but the attribution should still be treated as alleged rather than conclusively established pending any official confirmation.
Response and Fund Recovery Efforts
In the aftermath of the theft, approximately $1.1 million in assets were frozen through cooperation with Circle, Tether, and NEAR Intents. While this response demonstrates some capacity for rapid intervention within the crypto ecosystem, the frozen amount represents a small fraction of the total funds stolen, underscoring the ongoing difficulty of recovering assets once they move through blockchain networks and mixing services.
A recurring concern among industry watchers is what this incident signals about third-party security vendor risk across the crypto exchange sector. If a zero-day in widely used security appliances can be leveraged to bypass an exchange's defenses, the episode raises broader questions about supply-chain security practices industry-wide, even as specific technical details of the vulnerability remain undisclosed.