# Bitget $387.5M Cryptocurrency Theft via Third-Party Security Product Zero-Day (Suspected DPRK / TraderTraitor)

> Attackers stole about $387.5 million from Bitget hot and warm wallets on 24-25 September 2026 after exploiting a zero-day in an unnamed third-party security product (Product A) and compromising a second one (Product B), then using a custom withdrawal tool. Bitget attributes the intrusion to North Korean actors based on IP behavior and on-chain analysis; Mandiant and SlowMist are investigating.

- **Published:** 2026-10-01T00:00:00Z
- **Last reviewed:** 2026-10-01T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2823
- **ID:** TL-2026-2823
- **Severity:** CRITICAL
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** TraderTraitor (North Korea)
- **Detections:** 9 · **IOCs:** 5 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Bitget disclosed unauthorized transfers from its hot and warm wallets on 24 September 2026 (18:31 UTC; 02:31 on 25 September UTC+8). Initial estimates of $351.6M were revised to $387.5M after further ZEC and TRX losses were found. Bitget says private keys and cold wallets were not compromised and the exchange's User Protection Fund (reported above $464M) covers losses.

Per the interim SlowMist and Mandiant findings reported on 30 September 2026, the earliest malicious activity was on 31 August 2026 against 'Product A', an unnamed third-party security product, through a zero-day in a service running on a node. The attacker ran hidden scripts under that service process, read an environment variable holding the database password, and connected directly to the database. Similar hidden-script activity appeared on further nodes between 23 and 25 September.

On 24 September (about 16:07 UTC) the attacker moved into 'Product B', a security management platform, reportedly using an internal employee identity. SlowMist reports three consecutive system command injection attempts into task parameters, use of a web execution endpoint, relay communication files written to the server, and batch assembly and upload of malicious programs (first activity about 17:49 UTC). Mandiant found a web shell on security appliance B that established a command-and-control connection and allowed lateral movement to Bitget's production wallet job server, where malicious packages were deployed.

SlowMist recovered a deleted, highly customized tool built around the wallet system's withdrawal logic. It forged risk-control parameters, built withdrawal requests and invoked withdrawals, spoofing transaction data to trigger the exchange's normal authorization signing process. Theft ran in waves across 11 chains (Ethereum, XRP Ledger, Zcash, TRON, Arbitrum, Optimism, Base, BNB Smart Chain, Avalanche, Algorand, Celestia), with the largest wave of about $185M reported in roughly one minute around 19:16 UTC. The on-chain window closed around 21:23 UTC. Failed BTC withdrawal attempts and attempted log alterations were also observed.

Attribution to North Korean actors rests on IP behavior patterns and on-chain analysis. Elliptic and TRM Labs report wallet overlaps with earlier DPRK-attributed hacks, and Elliptic ties the laundering pattern to TraderTraitor. Funds were swapped within hours and routed through cross-chain venues including THORChain and Chainflip; Bitget asked THORChain to refuse service to attacker addresses, and about $632,700 was frozen by Circle, Tether and NEAR Intents. No government attribution has been issued. No CVE, vendor/product names, hashes, IPs, domains or wallet addresses had been published at the time of research.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1195 Supply Chain Compromise
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1505.003 Server Software Component: Web Shell
- T1552 Unsecured Credentials
- T1570 Lateral Tool Transfer
- T1071 Application Layer Protocol
- T1565.002 Data Manipulation: Transmitted Data Manipulation
- T1657 Financial Theft

## Sources

- [Bitget Confirms Third-Party Zero-Day Behind $387.5 Million Cryptocurrency Theft](https://thehackernews.com/2026/10/bitget-confirms-third-party-zero-day.html)
- [Bitget Says Suspected North Korean Actors Behind Cryptocurrency Theft](https://thehackernews.com/2026/09/bitget-says-suspected-north-korean.html)
- [Bitget hacked via zero-day in third-party security products](https://www.bleepingcomputer.com/news/security/bitget-hacked-via-zero-day-in-third-party-security-products/)
- [SlowMist Traces Bitget Hack Activity to Zero-Day Exploit](https://cointelegraph.com/news/bitget-hack-zero-day-slowmist-investigation)
- [Bitget $387.5M Hack: SlowMist and Mandiant Say Zero-Day Attack Began Weeks Before Theft](https://www.cryptotimes.io/2026/09/30/bitget-387-5m-hack-slowmist-and-mandiant-say-zero-day-attack-began-weeks-before-theft/)
- [Bitget blames North Korea for $387.5M crypto wallet raid](https://www.theregister.com/cyber-crime/2026/09/25/bitget-blames-north-korea-for-3875m-crypto-wallet-raid/5299218)
- [Bitget Raises Hack Losses to $387.5M After New ZEC and TRX Findings](https://en.coinotag.com/bitget-raises-hack-losses-387m-zec-trx)
- [Bitget formally asks THORChain to refuse service to attacker addresses](https://www.mitrade.com/insights/news/live-news/article-3-2118159-20260927)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2823