Attackers Stole $387.5 Million After Exploiting Zero-Day Flaws In Bitget Security Appliances

Zero-day led to theft

Attackers stole $387.5 million last week by breaching Bitget's systems after exploiting a zero-day flaw in third-party security products. The threat actors accessed Bitget's wallet environment after compromising two security appliances with zero-day exploits, then dropped web shells on one hacked appliance and malware on the crypto exchange's production wallet job server. SlowMist said the earliest malicious activity in available logs dates to August 31, when a service running on one of Product A's nodes was affected by a zero-day vulnerability.

Mandiant said a threat actor gained unauthorised privileged access to Bitget's third party security appliances A and B on September 24, deployed a web shell on security appliance B, and then moved laterally to Bitget's production wallet job server. SlowMist said the earliest crypto theft transfer occurred on September 02:31 (UTC+8) and the last took place at 05:23, with the attack spanning nearly 3 hours across multiple blockchains.

Reporting for this sectionBleepingComputer

Test transfers, then outflows

Gracy Chen said the breach stemmed from a vulnerability in a third-party security product that allowed the attacker to obtain "high-level internal credentials" and issue fraudulent withdrawal commands.

SlowMist said the attacker used a hidden script to access the database of what SlowMist called "Product A," after retrieving its password from an environment variable, and similar activity was later detected on two other nodes on Sept. 23 and Sept. 25.

SlowMist said the onchain verification found the earliest transfer verified to date at 2:31 am UTC+8 on Sept. 25, when an attacker-controlled address received 93 TRX, followed 11 seconds later by 0.84 Ether on Ethereum.

Chen described two small unauthorized transfers at 18:31 UTC, 0.184 ETH from an Ethereum hot wallet and 193 TRX from a Tron wallet, which fell below Bitget's risk-control threshold and did not trigger a system alert.

Bitget's reconciliation system detected a significant discrepancy at 19:05 UTC, seven minutes after the high-volume withdrawals began, and the exchange then blocked withdrawals initiated by users across the platform.

Reporting for this sectionCointelegraphFinanceFeeds

Withdrawals resume in stages

Bitget suspended all withdrawals on Thursday after detecting multiple unauthorized transfers from its hot and warm crypto wallets and discovering that attackers had stolen $387.5 million from them. Withdrawals for ETH and its EVM networks (Ethereum, BSC, Arbitrum, Base, Optimism) have resumed as scheduled, and the exchange said it would release a formal security report with more comprehensive technical details soon. Bitget resumed BTC withdrawals on Monday as part of a phased reboot, and the exchange said more than 3,000 BTC were processed in the first hour.

ETH withdrawals are expected to resume on September 29 on Ethereum, BSC, Arbitrum, Base, and Optimism, while USDT withdrawals follow on September 30 and other tokens, fiat withdrawals, and peer-to-peer services are to be restored by October 2. Bitget launched a Recovery Bounty Program offering bounties of 5% to those who help recover or freeze funds stolen in the attack, and Chen said an incident of this magnitude is very serious but does not mean existential.

Reporting for this sectionBleepingComputerFinanceFeeds