Bitget Lost $387.5M After Zero-Day in Third-Party Security Appliances

For security teams, the Bitget breach is a brutal reminder that the security stack itself can be the attack surface. Threat actors exploited zero-days in two third-party security appliances, then pivoted from appliance B to the production wallet job server using a web shell and C2. This is not a stolen API key or social engineering; it's a live, advanced intrusion chain that defeated defensive tooling.

The breach disclosure by cryptocurrency exchange Bitget on September 30, 2026 reveals a sophisticated intrusion that resulted in the theft of $387.5 million from the platform's hot and warm wallets. According to findings shared by blockchain security firm SlowMist and Google Cloud's Mandiant, attackers did not initially target Bitget's own infrastructure; they exploited zero-day vulnerabilities in two separate third-party security appliances. Those appliances, referred to only as Product A and Product B in the forensic reports, were the initial foothold. Once inside the security appliances, the threat actors established a persistent presence, moved laterally into Bitget's production wallet job server, and deployed a custom withdrawal tool that executed unauthorized transfers across multiple blockchains after midnight on September 25.

“

The breach disclosure by cryptocurrency exchange Bitget on September 30, 2026 reveals a sophisticated intrusion that resulted in the theft of $387.5 million from the platform's hot and warm wallets.

The forensic timeline is unusually detailed. SlowMist reported that the earliest malicious activity in available logs dates to August 31, when a service running on one of Product A's nodes was hit by a zero-day vulnerability. The attacker ran a hidden script under the service process, read an environment variable containing the database password, and connected to the database. Similar hidden-script activity was observed on two other nodes on September 23 and September 25. Mandiant's findings indicate that on September 24, 2026, a threat actor gained unauthorized privileged access to the third-party security appliances A and B, deployed a web shell onto security appliance B, and established a command-and-control connection. Using that persistent access, the actor moved laterally to Bitget's production wallet job server and deployed malicious packages. The actual theft transfers began at 02:31 UTC+8 on September 25 and ended at 05:23, spanning nearly three hours across multiple blockchains. Bitget suspended all withdrawals on Thursday after detecting the unauthorized transfers.

The use of zero-day vulnerabilities in third-party security products is particularly alarming because such appliances are typically trusted, privileged components of an enterprise network. They are designed to inspect traffic, enforce policy, and monitor for threats, yet in this case they became the attack surface. The threat actor converted a defensive tool into a pivot point, using a web shell on security appliance B to reach the production wallet environment. This represents a supply-chain style exposure even though the compromised products were not part of Bitget's codebase; they were third-party security infrastructure whose compromise opened a privileged path into the exchange. The attackers also deployed malware on the wallet job server and used a custom withdrawal tool, suggesting premeditated targeting of Bitget's transaction processing rather than a generic smash-and-grab.