Affected Systems

Bitget cryptocurrency exchange. Two unnamed third-party security appliances (referred to as "Product A" and "security appliance B") compromised via zero-day vulnerabilities. Attack impacted production wallet job servers and withdrawal systems across Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC, and Base chains. $387.5 million stolen across multiple cryptocurrencies (ETH, XRP, BNB, AVAX, USDT, USDC).

Exploitation Status

Active exploitation confirmed. Zero-day vulnerabilities in two third-party security products were exploited starting August 31, 2026. Attackers deployed web shells, malware, and custom withdrawal tools. Attribution points to North Korean threat actors based on IP patterns and on-chain analysis. No CVE assigned yet; vendor names not disclosed.

Business Impact

Organizations using third-party security appliances in cryptocurrency or financial infrastructure face supply chain risk from unpatched zero-days. The attackers maintained persistent access for nearly a month (August 31 to September 25) before executing the theft, demonstrating sophisticated operational security. Security appliances themselves became the attack vector, bypassing perimeter defenses. Incident highlights risk of privileged access to production systems through compromised security tooling. No public disclosure of affected vendor products prevents proactive defense by other organizations using the same appliances.

Urgency

🔴 Immediate

Recommended Actions

  • Audit all third-party security appliances with privileged network access for signs of compromise; review logs from August 31 onward for hidden scripts, unusual service processes, and database credential access
  • Implement network segmentation to isolate security appliances from production wallet servers and critical financial systems; restrict lateral movement paths
  • Monitor for web shell indicators on security appliances, particularly outbound C2 connections and unauthorized privileged access to backend systems
  • Review environment variable storage practices; avoid storing database passwords in cleartext environment variables accessible to service processes
  • Contact security appliance vendors for emergency patches if using products in cryptocurrency exchange or high-value transaction environments; demand transparency on zero-day status