Bitget attributes US$388 million theft to third-party zero-day as DPRK link remains unconfirmed

Bitget says attackers exploited a zero-day vulnerability in an unnamed third-party security product as part of the theft of approximately US$388 million from its exchange infrastructure on 24 September 2026. The exchange claims the attackers obtained privileged internal credentials and used forged withdrawal instructions to bypass its risk controls.

The account, published in Bitget updates on 28 and 29 September, provides the exchange’s most detailed explanation of the attack so far. It has not been validated in a public report from Mandiant, SlowMist or the unidentified product vendor. Separately, blockchain analytics company Elliptic assesses a link to the Democratic People’s Republic of Korea as highly likely, but the available evidence does not establish North Korean responsibility as confirmed fact.

Bitget records the first unauthorised transfers from some hot and warm wallets at 18:31:11 UTC on 24 September, according to its incident timeline. It says a reconciliation system detected a significant discrepancy at 19:05 UTC and risk controls then blocked platform withdrawals. By 21:44 UTC, Bitget says it had shut down wallet withdrawal and signing services and isolated withdrawal-related access. Deposits and trading continued. The Block and Elliptic independently observed large transfers from Bitget-labelled wallets to new addresses, followed by further on-chain movement of some assets, corroborating the occurrence and broad scale of the theft.

Bitget describes a compromised authorisation process

According to Bitget, the attackers exploited a previously unknown flaw in a security product operating within its internal environment. The exchange says they then obtained high-privilege credentials and injected fraudulent instructions into its wallet workflow, causing abnormal withdrawals to be processed as legitimate transactions.

This distinction matters because Bitget says neither its private keys nor its cold wallets were compromised. If its account is accurate, the theft shows that intact keys do not by themselves protect funds when attackers can compromise privileged credentials and the systems responsible for approving transactions. That conclusion remains dependent on Bitget’s description of the attack path, rather than a published independent forensic assessment.

Bitget says it isolated affected systems, reset credentials, restricted sensitive permissions and disabled relevant third-party functions. It also says it remediated the vulnerability in its environment, strengthened independent verification for withdrawals and notified the vendor. No CVE, affected product version, fixed version, vendor advisory or downloadable patch has been disclosed publicly.

The exchange says Mandiant and SlowMist are assisting with forensic work and fund tracing. No public findings from either company are identified in the evidence available at the cutoff, leaving a gap between Bitget’s internal account and material that outside specialists can examine.

Why the North Korea assessment is not confirmation

Elliptic assesses DPRK involvement as highly likely. Its analysis cites connections to addresses involved in earlier thefts attributed to North Korea, along with off-chain indicators and laundering behaviour. Bitget chief executive Gracy Chen has also described the perpetrator as likely to be a North Korean group, according to reporting by Tom’s Hardware.

Those indicators support reporting a suspected DPRK link, but they do not uniquely identify the attacker. Infrastructure can be shared, reused or imitated, and laundering patterns are not exclusive to one actor. Elliptic also notes that Bitget has not published the technical basis for its own attribution. No government attribution or evidence identifying a particular North Korean subgroup appears in the reviewed material.

The result is a strong assessment rather than a settled finding. Elliptic provides independent analysis supporting the probability of DPRK involvement, while the IP and VPN indicators reported from Bitget’s public presentation have not been published for public scrutiny.

The loss figure has evolved

Bitget’s latest incident page puts affected assets at approximately US$388 million across 12 hot or warm wallet addresses. Earlier official figures of US$351.6 million and US$387.5 million reflected changes in how transactions and assets were classified, rather than additional thefts occurring later. Bitget’s campaign page calls the latest amount final and verified, while its more detailed explainer leaves open the possibility of further classification changes.

The exchange says cold wallets were unaffected. The Block reported that the separate self-custodial Bitget Wallet product, which uses independent infrastructure, was also unaffected. Public reporting does not establish whether customer, employee or other sensitive data was accessed or exfiltrated.

Withdrawals were returning in phases

As of the 29 September evidence cutoff, Bitget said Bitcoin and Ether withdrawals had resumed. Tether withdrawals were scheduled to return at 08:00 UTC on 30 September, with remaining coins, fiat and peer-to-peer services scheduled for 08:00 UTC on 2 October. Completion of those later phases was not established by the available evidence.

Bitget says user account balances remained unaffected and that its Protection Fund, holding 5,500 BTC valued above US$464 million, would cover the financial impact. Those assurances have not been independently verified through a public post-incident assessment of the fund, reserves and liabilities.

The exchange also says some affected assets have been frozen, but it has not published a stable total for funds frozen or recovered because tracing remains in progress. Restoration of withdrawals reduces the immediate disruption for customers, but it does not resolve the separate questions of recovery, compensation and financial resilience.

Several questions therefore remain unresolved: the identity and affected versions of the third-party product; whether sensitive data was accessed; the independent forensic findings; and the amount actually frozen or recovered. Until those answers are published, the theft and its broad scale are well supported, while Bitget’s proposed attack chain and the DPRK attribution require distinct qualifications.

When an incident explanation depends on an undisclosed flaw, studying how weaknesses are tested in authorised, controlled settings can add defensive context without closing the public evidence gap. Explore The Hack Academy’s online cybersecurity training programme for self-paced study of cybersecurity fundamentals and penetration testing, with practical exercises alongside theory.