Bitget Hot/Warm Wallet Theft (~$387M) Attributed to North Korea-Linked Actors: Security-Tooling Compromise, Forged Withdrawals and Cross-Chain Laundering

Key facts

Detection coverage

As of 2026-11-11, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5727 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: TL-2026-5727 Bitget Product A - Security Product Service Spawning Interpreter With Inline Script

Detects a security-tooling service or agent process (the 'Product A' pattern in the Bitget wallet-theft intrusion) spawning a shell or script interpreter with inline code, download-and-execute pipes, /dev/tcp or staging-directory paths. Halborn reports a zero-day in a third-party security product let the attacker run a hidden script on production nodes from 2026-08-31 onward. Behaviour-first: it needs no CVE or vendor name, so it works while the product stays undisclosed.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1059
• Data sources: sysmon_for_linux, linux_process_creation, edr_process_telemetry
• Severity: high
• Confidence: medium

Splunk SPL

index=linux sourcetype="sysmon:linux" EventCode=1 earliest=-24h
| eval parent=lower(ParentImage), child=lower(Image), cmd=lower(CommandLine)
| where match(parent, "(secur|agent|edr|dlp|waf|siem|vuln|scanner|audit|monitor)") AND NOT match(parent, "/(sshd|bash|sh|dash|cron|crond|systemd|sudo|su)$")
| where match(child, "/(sh|bash|dash|zsh|python[0-9.]*|perl|ruby|node)$")
| where match(cmd, "( -c | -e |base64 +(-d|--decode)|(curl|wget)[^|]*\\|\\s*(ba)?sh|/dev/tcp/|/dev/shm/|/tmp/\\.)")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as commands values(ParentCommandLine) as parent_cmds by host, ParentImage, User
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")
| table first_seen last_seen host User ParentImage commands parent_cmds count

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("sh","bash","dash","zsh","python","python3","perl","ruby","node")
| where InitiatingProcessFileName !in~ ("sshd","bash","sh","dash","cron","crond","systemd","sudo","su")
| where InitiatingProcessFolderPath matches regex @"(?i)(secur|agent|edr|dlp|waf|siem|vuln|scanner|audit|monitor)"
| where ProcessCommandLine matches regex @"( -c | -e |base64 +(-d|--decode)|(curl|wget)[^|]*\|\s*(ba)?sh|/dev/tcp/|/dev/shm/|/tmp/\.)"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessCommandLine, FileName, ProcessCommandLine
| order by Timestamp desc

Sigma

title: Security Product Service Spawning Interpreter With Inline Script (Bitget TL-2026-5727)
id: 7b1f3c52-8d4e-4a61-9f0a-2c5e6d1a9b01
status: experimental
description: Detects a security-tooling service or agent spawning a shell or script interpreter with inline code, download-and-execute pipes or staging paths, matching the Product A hidden-script activity in the Bitget intrusion.
references:
  - https://www.halborn.com/blog/post/bitget-hack-technical-analysis-september-2026
  - https://thehackernews.com/2026/09/bitget-says-suspected-north-korean.html
author: Threadlinqs Team
date: 2026-11-11
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
      - 'secur'
      - 'agent'
      - 'edr'
      - 'dlp'
      - 'waf'
      - 'siem'
      - 'vuln'
      - 'scanner'
      - 'audit'
      - 'monitor'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/perl'
      - '/ruby'
      - '/node'
  selection_py:
    Image|contains: '/python'
  selection_cmd:
    CommandLine|contains:
      - ' -c '
      - ' -e '
      - 'base64 -d'
      - 'base64 --decode'
      - '| sh'
      - '| bash'
      - '/dev/tcp/'
      - '/dev/shm/'
      - '/tmp/.'
  filter_parent:
    ParentImage|endswith:
      - '/sshd'
      - '/bash'
      - '/sh'
      - '/dash'
      - '/cron'
      - '/crond'
      - '/systemd'
      - '/sudo'
      - '/su'
  condition: selection_parent and (selection_child or selection_py) and selection_cmd and not filter_parent
falsepositives:
  - Security agents running legitimate self-update or health-check scripts
  - Administrator maintenance of monitoring agents
level: high

Known false positives:

• Security or monitoring agents running legitimate self-update, health-check or remediation scripts through a shell
• Administrators using agent-provided remote-command features during maintenance windows

Tuning notes: Adjust the index and sourcetype to your Linux process telemetry. Replace the generic security-tool keyword regex with the actual agent and appliance install paths in your estate, and allowlist the exact script paths your vendors run. Scope to tier-0 hosts (wallet hosts and security appliances) first. For a retrospective hunt, widen earliest to -90d, since the earliest activity dates to 2026-08-31.

• 🔒 TL-2026-5727 Bitget Product B - Command Injection In Management Platform Task Parameters · unlock with TL Creds
• 🔒 TL-2026-5727 Bitget Withdrawal Tool - Staged Binary Executed On Wallet Host Then Deleted · unlock with TL Creds
• 🔒 TL-2026-5727 Bitget Forged Withdrawals - Transfers To Attacker Addresses Or Without A Ledger Order · unlock with TL Creds
• 🔒 TL-2026-5727 Bitget Product A - Environment Variable Credential Read And Database Client Launch By Security Tool · unlock with TL Creds
• 🔒 TL-2026-5727 Bitget Wallet Job Server - Malicious Package Installed From Remote Or Staging Source · unlock with TL Creds
• 🔒 TL-2026-5727 Bitget Appliance C2 - Security Tool Direct-To-IP Egress On Non-Standard Web Ports · unlock with TL Creds
• 🔒 TL-2026-5727 Bitget Product B - Web Shell Written To Management Platform Web Root · unlock with TL Creds
• 🔒 TL-2026-5727 Bitget DPRK-Linked Community C2 Infrastructure Contact (Firewall and DNS) · unlock with TL Creds

Indicators of compromise

As of 2026-11-11, Threadlinqs Intelligence tracks 13 indicators of compromise for TL-2026-5727.

Sample indicators (1 of 13)

• File hash: 2380584fe493b68403b1e1d5848118590c9b8c323efe630426e26b15523f125e

Defanged, TLP:CLEAR. Full set of 13 indicators: unlock with TL Creds.

Technical analysis

Bitget disclosed on 2026-09-24/25 that unauthorized transfers left a limited number of hot wallets, later extended to warm wallets. The first loss estimate was about $351.6M; later figures were about $387.5M (Chainalysis, BlockSec) and about $390.06M transferred to attacker-controlled addresses per Bitget's on-chain tracing. Assets included ETH, XRP, BNB, AVAX, USDT, USDC and XAUt across Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC, Base, Tron and Zcash. Cold wallets and the separately hosted Bitget Wallet product were reported unaffected. It is the largest single suspected North Korean theft of 2026 tracked by Elliptic.

Per Bitget's CEO, the attacker compromised a critical backend system in the wallet infrastructure, spoofed transaction data and triggered the authorization process; no private keys were stolen. Halborn's synthesis of forensic reports (Mandiant calls the tools 'security appliances A and B'; vendors, CVEs and versions are undisclosed) describes a zero-day in a service on a third-party security product ('Product A') that let the attacker run a hidden script, read a database password from an environment variable and connect to the database. On a second product ('Product B') the attacker abused an internal employee's identity on the management platform, attempted command injection through task parameters and submitted code via a web execution endpoint. Mandiant reports a web shell and C2 channel on appliance B, then access to the production wallet job server and deployment of malicious packages. A purpose-built withdrawal tool on the wallet host forged risk-control fields and invoked the withdrawal process; the signing service trusted the wallet host and the host-supplied risk decision, nothing restricted destination addresses for hot/warm wallets, and Bitget's own signer produced valid signatures on forged instructions. Earliest malicious activity in available logs is 2026-08-31 (at least ~24 days of dwell time). Anti-forensics included log review, tool deletion and attempted database record tampering.

On 2026-09-24 test transfers (93 TRX, 0.84 ETH) at 18:31 UTC were followed by a 34.75M USDT transfer at 18:58, and two bursts (about $87.6M at 19:01 and about $203.1M at 19:16). 23 transfers were traced by Bitquery; the last at 21:23 UTC. Bitget shut down signing and withdrawals at 21:44 UTC. Laundering: stablecoins were swapped to native assets within about 41 minutes; BlockSec reports consolidation into BTC mainly through THORChain (about $269M pass-through), plus Chainflip, NEAR Intents, USDT0/LayerZero, CCTP, Across, Stargate, UniswapX/Uniswap/1inch and a Bitcoin CoinJoin; ZachXBT reported movement toward Wasabi (unverified). As of about 2026-09-29 the attacker still held about $342M (88.3%); only about $0.84M (0.2%) had been frozen (Circle, Tether, NEAR Intents). THORChain declined Bitget's request to block attacker addresses. Chainalysis reported the funds landed on four chains: Ethereum 49.7%, XRP 40.8%, Zcash 7.6%, Tron 1.8%.

Attribution is assessed, not confirmed. Bitget's CEO said IP behavior and on-chain patterns are highly consistent with North Korean groups (technical basis unpublished). Elliptic rates the link highly likely, citing XRP linked to ETH from a prior DPRK-attributed exploit and overlap with addresses used to launder the 2025 Bybit exploit; TRM Labs reports wallet overlaps with Bybit and AFX Bridge laundering that point to TraderTraitor but has not definitively attributed; Chainalysis attributed the theft to North Korea-linked actors on 2026-10-01; Halborn works on a TraderTraitor assumption; Mandiant, SlowMist and Bitget's official position make no attribution and no government had attributed as of 2026-10-02. BlockSec cautions that overlaps may reflect shared laundering groups rather than the same attackers. DarkOwl (2026-10-27) assesses that earlier-heist laundering infrastructure (mixers, bridges, OTC brokers, dark web forums) is very likely processing the funds. The sources provide no malware hashes, domains or IPs; the IOCs below are on-chain addresses, laundering services and behavioral indicators. BeaconBeagle correlation was not applicable because no IP or domain IOCs exist in the sources.

MITRE ATT&CK techniques by tactic:

Execution

T1059 Command and Scripting Interpreter

Defense Evasion

T1070.004 Indicator Removal: File Deletion

Command and Control

T1071 Application Layer Protocol

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Persistence

T1505.003 Server Software Component: Web Shell

Credential Access

T1552 Unsecured Credentials

Impact

T1565 Data Manipulation; T1657 Financial Theft

Remediation

Patches

• Bitget reported on 2026-09-26 that the exploited vulnerability was identified and addressed; vendor, CVE and version details are undisclosed
• Apply vendor patches for security and management appliances on wallet hosts as they become available

Immediate actions

• Have the signer verify risk decisions independently: bind risk-engine approval to destination, asset, amount and order ID, and reject host-asserted risk fields
• Enforce destination allowlists inside the signing boundary for hot/warm wallets and sweeps, with time-locked out-of-band allowlist changes
• Reconcile every outbound operational-wallet transaction to a ledger order within seconds and alert on any unmatched transfer
• Screen inbound deposits and outbound flows against the attacker addresses and laundering routes listed in the IOCs

Workarounds

• Retrospective hunt (90+ days): security-product services spawning scripts or reading environment variables, unusual-hour console logins under staff identities, new files in management-platform web roots, shell syntax in task parameters

Longer-term hardening

• Treat security and management tooling that can run tasks, push files or open shells on wallet hosts as tier 0: inventory, minimize reach and isolate consoles
• Apply execution allowlisting and integrity monitoring on wallet hosts, alerting on new processes and packages
• Remove secrets from environment variables, use short-lived vault-issued credentials, audit withdrawal tables and ship logs off-host to immutable storage
• Maintain a rehearsed signing kill switch that halts signing on all chains independent of the wallet backend, and measure alert-to-stop time
• Enforce multi-person approval and per-transaction/time-window value caps on warm wallets at the signer
• Monitor dark web and on-chain laundering infrastructure reused across DPRK incidents

Affected and fixed versions

• Bitget — Bitget exchange hot and warm wallet infrastructure
  Vulnerable versions: Environment as of 2026-09-24 (withdrawal signing path trusting host-supplied risk fields)
  Fixed in: Vulnerability reported as identified and addressed on 2026-09-26
• Undisclosed — Two third-party security/management products in Bitget's production environment (Product A and Product B)
  Vulnerable versions: Undisclosed

Timeline

• 2026-08-31 Earliest malicious activity in available logs: hidden-script activity on a third-party security product ('Product A') node in Bitget's production environment (Halborn)
• 2026-09-23 Same hidden-script activity observed on additional Product A nodes (Halborn)
• 2026-09-24 Bitget CEO discloses the incident publicly (~21:30 UTC); signing and withdrawal services shut down at 21:44 UTC; stablecoins swapped to ETH/AVAX within ~41 minutes of theft
• 2026-09-24 Large outflows begin 18:58 UTC (34.75M USDT), bursts of about $87.6M (19:01) and about $203.1M (19:16); reconciliation flags a discrepancy at 19:05 and user withdrawals are blocked; last traced transfer 21:23 UTC
• 2026-09-24 Console abuse on Product B under an employee identity at 16:07 UTC; purpose-built withdrawal tool starts on the wallet host at 17:49 UTC; test transfers of 93 TRX and 0.84 ETH at 18:31 UTC
• 2026-09-25 Circle and Tether freeze about $340K; Elliptic reports the link to DPRK-attributed laundering as highly likely and that suspected DPRK 2026 theft passes $1B; root cause identified and law enforcement notified
• 2026-09-26 Bitget says the exploited vulnerability was identified and addressed; CEO asks THORChain to refuse service to attacker addresses (THORChain declines on permissionless-design grounds)
• 2026-09-27 Bitcoin CoinJoin transaction (356 inputs, 401 outputs) confirmed at 11:03 UTC as part of laundering (BlockSec)
• 2026-09-28 Phased resumption of withdrawals begins; NEAR Intents discloses freezes; Tether freezes Tron funds; loss estimate revised to about $387.5M-$390.06M
• 2026-10-01 Chainalysis attributes the theft to North Korea-linked actors; no government attribution as of 2026-10-02 (Halborn)
• 2026-10-27 DarkOwl assesses that laundering infrastructure from earlier 2026 DPRK heists is very likely processing the Bitget funds

Sources cited

• Bitget attack pushes suspected North Korea crypto heists over $1 billion in 2026 elliptic.co · Research · 2026-09-25
• The Bitget Hack: a CISO's Technical Analysis halborn.com · Research · 2026-10-02
• Bitget's $387M Hack: Laundering Path, Freezes and Attribution blocksec.com · Research · 2026-09-29
• North Korea's Billion-Dollar Year: What the Bitget Hack Reveals About Crypto Laundering on the Dark Web darkowl.com · Blog · 2026-10-27
• Bitget Says Suspected North Korean Hackers Stole $351.6M After Backend Compromise The Hacker News · News · 2026-09-26
• Crypto platform Bitget suspects North Korea in $352 million hack cnbc.com · News · 2026-09-25
• Bitget blames North Korea for $387.5M crypto wallet raid The Register · News · 2026-09-25
• Chainalysis Attributes $387M Bitget Hack to North Korea as 2026 Thefts Top $1B cryptorank.io · News · 2026-10-01
• Bitget Hack Investigation Uncovers Laundering Trail, North Korean Links en.cryptonomist.ch · News · 2026-09-28
• Bitget resumes Bitcoin withdrawals after $387.5 million crypto heist BleepingComputer · News · 2026-09-28

More in apt

• Iran-Backed Network (IRGC / Kataib Hezbollah / HAYI) Directed London and European Attacks over FaceTime
• North Korean Contagious Interview (WaterPlum) Campaign Compromises 30,000+ Devices, Steals $10.71M in Crypto
• Silent Lynx (UAT-6275 / TAG-193) exposed server: Laplas/Chvost implants and AI-agent-driven intrusions against Tajikistan railway and EDO, Uzbekistan Smart Forestry, and Turkmenistan-themed lures
• Imperial Kitten (Tortoiseshell / UNC1549 / Nimbus Manticore) Iranian IRGC-linked APT: TWOSTROKE, MINIBIKE/MiniJunk, LIGHTRAIL, TRUSTTRAP Targeting Aerospace, Defense and IT
• Beyond Lazarus: Organization of DPRK Cyber Capabilities (GRIB/NIA structure, six Lazarus sub-clusters, fake IT worker and laundering ecosystem)

Further reading

• Axios Supply Chain Attack: Cross-Platform RATs