# Bitget Hot/Warm Wallet Theft (~$387M) Attributed to North Korea-Linked Actors: Security-Tooling Compromise, Forged Withdrawals and Cross-Chain Laundering

> On 2026-09-24 Bitget lost roughly $351.6M-$390M from hot and warm wallets after attackers compromised backend wallet infrastructure and forged withdrawal requests, without stealing private keys. Bitget's CEO and several on-chain analytics firms assess North Korean (TraderTraitor-style) involvement as likely; Elliptic reports suspected DPRK 2026 crypto theft now exceeds $1B, while Mandiant, SlowMist and Bitget's official position make no formal attribution.

- **Published:** 2026-11-11T04:59:30Z
- **Last reviewed:** 2026-11-11T04:59:30Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5727
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5727.png
- **ID:** TL-2026-5727
- **Severity:** HIGH
- **Category:** APT
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 13 (1 shown free below)

## Description

Bitget disclosed on 2026-09-24/25 that unauthorized transfers left a limited number of hot wallets, later extended to warm wallets. The first loss estimate was about $351.6M; later figures were about $387.5M (Chainalysis, BlockSec) and about $390.06M transferred to attacker-controlled addresses per Bitget's on-chain tracing. Assets included ETH, XRP, BNB, AVAX, USDT, USDC and XAUt across Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC, Base, Tron and Zcash. Cold wallets and the separately hosted Bitget Wallet product were reported unaffected. It is the largest single suspected North Korean theft of 2026 tracked by Elliptic.

Per Bitget's CEO, the attacker compromised a critical backend system in the wallet infrastructure, spoofed transaction data and triggered the authorization process; no private keys were stolen. Halborn's synthesis of forensic reports (Mandiant calls the tools 'security appliances A and B'; vendors, CVEs and versions are undisclosed) describes a zero-day in a service on a third-party security product ('Product A') that let the attacker run a hidden script, read a database password from an environment variable and connect to the database. On a second product ('Product B') the attacker abused an internal employee's identity on the management platform, attempted command injection through task parameters and submitted code via a web execution endpoint. Mandiant reports a web shell and C2 channel on appliance B, then access to the production wallet job server and deployment of malicious packages. A purpose-built withdrawal tool on the wallet host forged risk-control fields and invoked the withdrawal process; the signing service trusted the wallet host and the host-supplied risk decision, nothing restricted destination addresses for hot/warm wallets, and Bitget's own signer produced valid signatures on forged instructions. Earliest malicious activity in available logs is 2026-08-31 (at least ~24 days of dwell time). Anti-forensics included log review, tool deletion and attempted database record tampering.

On 2026-09-24 test transfers (93 TRX, 0.84 ETH) at 18:31 UTC were followed by a 34.75M USDT transfer at 18:58, and two bursts (about $87.6M at 19:01 and about $203.1M at 19:16). 23 transfers were traced by Bitquery; the last at 21:23 UTC. Bitget shut down signing and withdrawals at 21:44 UTC. Laundering: stablecoins were swapped to native assets within about 41 minutes; BlockSec reports consolidation into BTC mainly through THORChain (about $269M pass-through), plus Chainflip, NEAR Intents, USDT0/LayerZero, CCTP, Across, Stargate, UniswapX/Uniswap/1inch and a Bitcoin CoinJoin; ZachXBT reported movement toward Wasabi (unverified). As of about 2026-09-29 the attacker still held about $342M (88.3%); only about $0.84M (0.2%) had been frozen (Circle, Tether, NEAR Intents). THORChain declined Bitget's request to block attacker addresses. Chainalysis reported the funds landed on four chains: Ethereum 49.7%, XRP 40.8%, Zcash 7.6%, Tron 1.8%.

Attribution is assessed, not confirmed. Bitget's CEO said IP behavior and on-chain patterns are highly consistent with North Korean groups (technical basis unpublished). Elliptic rates the link highly likely, citing XRP linked to ETH from a prior DPRK-attributed exploit and overlap with addresses used to launder the 2025 Bybit exploit; TRM Labs reports wallet overlaps with Bybit and AFX Bridge laundering that point to TraderTraitor but has not definitively attributed; Chainalysis attributed the theft to North Korea-linked actors on 2026-10-01; Halborn works on a TraderTraitor assumption; Mandiant, SlowMist and Bitget's official position make no attribution and no government had attributed as of 2026-10-02. BlockSec cautions that overlaps may reflect shared laundering groups rather than the same attackers. DarkOwl (2026-10-27) assesses that earlier-heist laundering infrastructure (mixers, bridges, OTC brokers, dark web forums) is very likely processing the funds. The sources provide no malware hashes, domains or IPs; the IOCs below are on-chain addresses, laundering services and behavioral indicators. BeaconBeagle correlation was not applicable because no IP or domain IOCs exist in the sources.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1505.003 Server Software Component: Web Shell
- T1070.004 Indicator Removal: File Deletion
- T1552 Unsecured Credentials
- T1071 Application Layer Protocol
- T1565 Data Manipulation
- T1657 Financial Theft

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**TL-2026-5727 Bitget Product A - Security Product Service Spawning Interpreter With Inline Script** (`TL-2026-5727-SPL-001`)

Detects a security-tooling service or agent process (the 'Product A' pattern in the Bitget wallet-theft intrusion) spawning a shell or script interpreter with inline code, download-and-execute pipes, /dev/tcp or staging-directory paths. Halborn reports a zero-day in a third-party security product let the attacker run a hidden script on production nodes from 2026-08-31 onward. Behaviour-first: it needs no CVE or vendor name, so it works while the product stays undisclosed.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1059
- **Data sources:** sysmon_for_linux, linux_process_creation, edr_process_telemetry
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=linux sourcetype="sysmon:linux" EventCode=1 earliest=-24h
| eval parent=lower(ParentImage), child=lower(Image), cmd=lower(CommandLine)
| where match(parent, "(secur|agent|edr|dlp|waf|siem|vuln|scanner|audit|monitor)") AND NOT match(parent, "/(sshd|bash|sh|dash|cron|crond|systemd|sudo|su)$")
| where match(child, "/(sh|bash|dash|zsh|python[0-9.]*|perl|ruby|node)$")
| where match(cmd, "( -c | -e |base64 +(-d|--decode)|(curl|wget)[^|]*\\|\\s*(ba)?sh|/dev/tcp/|/dev/shm/|/tmp/\\.)")
| stats count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as commands values(ParentCommandLine) as parent_cmds by host, ParentImage, User
| eval first_seen=strftime(first_seen,"%F %T"), last_seen=strftime(last_seen,"%F %T")
| table first_seen last_seen host User ParentImage commands parent_cmds count
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("sh","bash","dash","zsh","python","python3","perl","ruby","node")
| where InitiatingProcessFileName !in~ ("sshd","bash","sh","dash","cron","crond","systemd","sudo","su")
| where InitiatingProcessFolderPath matches regex @"(?i)(secur|agent|edr|dlp|waf|siem|vuln|scanner|audit|monitor)"
| where ProcessCommandLine matches regex @"( -c | -e |base64 +(-d|--decode)|(curl|wget)[^|]*\|\s*(ba)?sh|/dev/tcp/|/dev/shm/|/tmp/\.)"
| project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, InitiatingProcessFolderPath, InitiatingProcessCommandLine, FileName, ProcessCommandLine
| order by Timestamp desc
```

### Sigma

```yaml
title: Security Product Service Spawning Interpreter With Inline Script (Bitget TL-2026-5727)
id: 7b1f3c52-8d4e-4a61-9f0a-2c5e6d1a9b01
status: experimental
description: Detects a security-tooling service or agent spawning a shell or script interpreter with inline code, download-and-execute pipes or staging paths, matching the Product A hidden-script activity in the Bitget intrusion.
references:
  - https://www.halborn.com/blog/post/bitget-hack-technical-analysis-september-2026
  - https://thehackernews.com/2026/09/bitget-says-suspected-north-korean.html
author: Threadlinqs Team
date: 2026-11-11
tags:
  - attack.initial_access
  - attack.t1190
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|contains:
      - 'secur'
      - 'agent'
      - 'edr'
      - 'dlp'
      - 'waf'
      - 'siem'
      - 'vuln'
      - 'scanner'
      - 'audit'
      - 'monitor'
  selection_child:
    Image|endswith:
      - '/sh'
      - '/bash'
      - '/dash'
      - '/zsh'
      - '/perl'
      - '/ruby'
      - '/node'
  selection_py:
    Image|contains: '/python'
  selection_cmd:
    CommandLine|contains:
      - ' -c '
      - ' -e '
      - 'base64 -d'
      - 'base64 --decode'
      - '| sh'
      - '| bash'
      - '/dev/tcp/'
      - '/dev/shm/'
      - '/tmp/.'
  filter_parent:
    ParentImage|endswith:
      - '/sshd'
      - '/bash'
      - '/sh'
      - '/dash'
      - '/cron'
      - '/crond'
      - '/systemd'
      - '/sudo'
      - '/su'
  condition: selection_parent and (selection_child or selection_py) and selection_cmd and not filter_parent
falsepositives:
  - Security agents running legitimate self-update or health-check scripts
  - Administrator maintenance of monitoring agents
level: high

```

**Known false positives:**

- Security or monitoring agents running legitimate self-update, health-check or remediation scripts through a shell
- Administrators using agent-provided remote-command features during maintenance windows

**Tuning notes:** Adjust the index and sourcetype to your Linux process telemetry. Replace the generic security-tool keyword regex with the actual agent and appliance install paths in your estate, and allowlist the exact script paths your vendors run. Scope to tier-0 hosts (wallet hosts and security appliances) first. For a retrospective hunt, widen earliest to -90d, since the earliest activity dates to 2026-08-31.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- TL-2026-5727 Bitget Product B - Command Injection In Management Platform Task Parameters (locked: unlock with TL Creds)
- TL-2026-5727 Bitget Withdrawal Tool - Staged Binary Executed On Wallet Host Then Deleted (locked: unlock with TL Creds)
- TL-2026-5727 Bitget Forged Withdrawals - Transfers To Attacker Addresses Or Without A Ledger Order (locked: unlock with TL Creds)
- TL-2026-5727 Bitget Product A - Environment Variable Credential Read And Database Client Launch By Security Tool (locked: unlock with TL Creds)
- TL-2026-5727 Bitget Wallet Job Server - Malicious Package Installed From Remote Or Staging Source (locked: unlock with TL Creds)
- TL-2026-5727 Bitget Appliance C2 - Security Tool Direct-To-IP Egress On Non-Standard Web Ports (locked: unlock with TL Creds)
- TL-2026-5727 Bitget Product B - Web Shell Written To Management Platform Web Root (locked: unlock with TL Creds)
- TL-2026-5727 Bitget DPRK-Linked Community C2 Infrastructure Contact (Firewall and DNS) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (1 of 13)

Defanged, TLP:CLEAR.

- File hash: `2380584fe493b68403b1e1d5848118590c9b8c323efe630426e26b15523f125e`

Full set of 13 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [North Korea's Billion-Dollar Year: What the Bitget Hack Reveals About Crypto Laundering on the Dark Web](https://www.darkowl.com/blog-content/north-koreas-billion-dollar-year/)
- [Bitget Says Suspected North Korean Hackers Stole $351.6M After Backend Compromise](https://thehackernews.com/2026/09/bitget-says-suspected-north-korean.html)
- [Bitget attack pushes suspected North Korea crypto heists over $1 billion in 2026](https://www.elliptic.co/insights/bitget-attack-pushes-suspected-north-korea-crypto-heists-over-1-billion-in-2026-2/)
- [The Bitget Hack: a CISO's Technical Analysis](https://www.halborn.com/blog/post/bitget-hack-technical-analysis-september-2026)
- [Bitget's $387M Hack: Laundering Path, Freezes and Attribution](https://blocksec.com/blog/bitget-hack-laundering-fund-tracing)
- [Crypto platform Bitget suspects North Korea in $352 million hack](https://www.cnbc.com/2026/09/25/crypto-platform-bitget-suspects-north-korea-in-352-million-hack.html)
- [Bitget blames North Korea for $387.5M crypto wallet raid](https://www.theregister.com/cyber-crime/2026/09/25/bitget-blames-north-korea-for-3875m-crypto-wallet-raid/5299218)
- [Chainalysis Attributes $387M Bitget Hack to North Korea as 2026 Thefts Top $1B](https://cryptorank.io/news/feed/71c0b-chainalysis-bitget-hack-north-korea)
- [Bitget Hack Investigation Uncovers Laundering Trail, North Korean Links](https://en.cryptonomist.ch/2026/09/28/bitget-hack-investigation/)
- [Bitget resumes Bitcoin withdrawals after $387.5 million crypto heist](https://bleepingcomputer.com/news/security/bitget-resumes-bitcoin-withdrawals-after-3875-million-crypto-heist)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5727