Affected Systems

Bitget cryptocurrency exchange; third-party security products (Product A and Product B, vendors unnamed); 11 blockchains including Ethereum, XRP Ledger, Zcash, TRON, Arbitrum, Optimism, Base, BNB Smart Chain, Avalanche, Algorand, and Celestia. Attackers compromised security appliances starting August 31, 2026, culminating in asset theft September 25, 2026.

Exploitation Status

Actively exploited in the wild. Zero-day vulnerability in third-party security products exploited by suspected North Korean threat actors. Attack timeline spans August 31 to September 25, 2026. Custom tooling recovered by SlowMist; web shell and C2 infrastructure identified by Mandiant. No CVE assigned yet.

Business Impact

Direct financial loss of $387.5 million from hot and warm wallets. Attackers obtained high-level internal credentials, bypassed risk controls, and executed unauthorized withdrawals. Lateral movement from compromised security appliances to production wallet infrastructure demonstrates supply chain risk. Organizations using similar third-party security products for credential management or network security face elevated risk until vendors are identified and patches released. Bitget has disabled affected functionality and halted withdrawals temporarily.

Urgency

🔴 Immediate

Recommended Actions

  • Audit all third-party security appliances with access to production environments, especially those handling credentials or database access; review logs from August 31, 2026 onward for hidden scripts, unauthorized database connections, or command injection attempts.
  • Monitor for web shell deployment on security appliances and inspect task parameters or web execution endpoints for system command injection attempts similar to those observed on Product B.
  • Review access controls for production wallet or financial systems; ensure security appliances cannot directly access high-privilege credentials or execute commands on critical job servers without additional authentication layers.
  • Correlate internal employee identity usage on management platforms with known login patterns; investigate anomalous access attempts or repeated command injection failures on September 23-25, 2026 timeframe.
  • Engage with third-party security product vendors to confirm patch status for zero-day vulnerabilities disclosed in late September 2026; prioritize vendors providing network security appliances or credential management solutions used in cryptocurrency or financial environments.