Affected Systems

Bitget cryptocurrency exchange. The unnamed third-party security product used by Bitget contained a zero-day vulnerability that allowed credential theft. Hot and warm wallets were compromised; cold wallets unaffected. No customer account balances impacted.

Exploitation Status

Actively exploited on September 24, 2026. Attacker used zero-day vulnerability to obtain high-level internal credentials, then executed fraudulent withdrawal commands. Suspected North Korean threat actor (possibly TraderTraitor group). No PoC publicly available; vendor not named, patch status unknown.

Business Impact

Direct financial loss of $388 million covered by Bitget's Protection Fund. Customer funds protected, no user action required. Demonstrates supply chain risk: third-party security products can become attack vectors. Organizations using similar hot/warm wallet architectures or third-party credential management tools face elevated risk. Vendor has been notified but no public disclosure or patch confirmation yet, leaving other customers of the unnamed product potentially exposed.

Urgency

🔴 Immediate

Recommended Actions

  • Audit all third-party security products with access to privileged credentials or internal management systems; prioritize those with wallet or financial system access.
  • Implement independent, out-of-band verification for high-value transactions that cannot be bypassed via compromised backend systems.
  • Rotate all privileged credentials and API keys used by third-party security tools, especially those with administrative access to financial or wallet infrastructure.
  • Monitor blockchain addresses published by Bitget (0x770b10b273fc44fe9197d6bf20f145c2e98463ee on Ethereum/EVM, rwNhefsz1UQEusxhCvHip3RANinWi4CTck on XRP, TBWNguTTgezw9dVorX441C6nDrZpRxYwKD on TRON, t1WgMdtND8NF7NDUuYmq8MpMj1NTCXkMDVG on Zcash) and screen incoming deposits for indirect transfers via bridges and swaps.
  • Review withdrawal approval workflows to ensure risk controls cannot be bypassed by spoofed transaction data from compromised backend services.