{
 "slug": "bitget-hot-wallet-breach-zero-day-sep-2026",
 "title": "Bitget hot and warm wallets drained of $387.5M after zero-day in third-party security appliances",
 "url": "https://drains.watch/i/bitget-hot-wallet-breach-zero-day-sep-2026",
 "json": "https://drains.watch/i/bitget-hot-wallet-breach-zero-day-sep-2026.json",
 "status": "live",
 "severity": "critical",
 "threatStatus": "contained",
 "verification": "verified",
 "chains": [
  "ethereum",
  "arbitrum",
  "avalanche",
  "optimism",
  "bsc",
  "base"
 ],
 "method": null,
 "product": "Bitget exchange hot and warm wallets",
 "tags": [
  "ethereum",
  "arbitrum",
  "avalanche",
  "optimism",
  "bsc",
  "base",
  "exchange",
  "bitget",
  "hot-wallet",
  "zero-day",
  "infrastructure-breach",
  "dprk"
 ],
 "amountUsd": 387500000,
 "victims": null,
 "startedAt": "2026-09-24",
 "closedAt": "2026-09-28",
 "updatedAt": "2026-10-15T12:00:00Z",
 "summary": "Attackers exploited a zero-day in two third-party security appliances at exchange Bitget, moved on to its production wallet job server and used a custom withdrawal tool to drain hot and warm wallets on 24-25 September 2026. The confirmed loss is about $387.5 million (first reported as $351.6M) across Ethereum, Arbitrum, Avalanche, Optimism, BSC, Base and the XRP Ledger. Bitget's CEO blamed North Korean hackers, and Bitget said cold wallets and private keys were not compromised. Hacken's Q3 figures say about $387M was covered by Bitget's user protection fund.",
 "timeline": [
  {
   "date": "2026-08-31",
   "title": "SlowMist's report traced the earliest malicious activity in Bitget's logs to 31 August.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/bitget-hacked-via-zero-day-in-third-party-security-products/"
  },
  {
   "date": "2026-09-24",
   "title": "Per Mandiant, the attacker gained privileged access to two third-party security appliances, then reached the wallet job server and deployed malicious packages.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/bitget-hacked-via-zero-day-in-third-party-security-products/"
  },
  {
   "date": "2026-09-25",
   "title": "A custom withdrawal tool drained hot and warm wallets over nearly three hours after midnight (UTC+8); Bitget suspended withdrawals.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/bitget-hacked-via-zero-day-in-third-party-security-products/"
  },
  {
   "date": "2026-09-28",
   "title": "Bitget resumed Bitcoin withdrawals.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/bitget-resumes-bitcoin-withdrawals-after-3875-million-crypto-heist/"
  },
  {
   "date": "2026-10-01",
   "title": "The confirmed loss was put at $387.5 million, up from the first estimate of $351.6 million.",
   "sourceUrl": "https://crypto.news/crypto-loses-768m-in-worst-hack-month-of-2026/"
  },
  {
   "date": "2026-10-15",
   "title": "Hacken's Q3 data showed about $387M covered by Bitget's user protection fund; Circle and Tether froze about $340,000 tied to the theft.",
   "sourceUrl": "https://cointelegraph.com/news/bitget-liquid-exploits-push-crypto-hacks-near-12b-q3"
  }
 ],
 "sources": [
  {
   "kind": "news",
   "title": "Bitget hacked via zero-day in third-party security products",
   "url": "https://www.bleepingcomputer.com/news/security/bitget-hacked-via-zero-day-in-third-party-security-products/",
   "publisher": "BleepingComputer",
   "date": "2026-09-30"
  },
  {
   "kind": "news",
   "title": "Bitget resumes Bitcoin withdrawals after $387.5 million crypto heist",
   "url": "https://www.bleepingcomputer.com/news/security/bitget-resumes-bitcoin-withdrawals-after-3875-million-crypto-heist/",
   "publisher": "BleepingComputer",
   "date": "2026-09-28"
  },
  {
   "kind": "news",
   "title": "Crypto loses $768M in worst hack month of 2026",
   "url": "https://crypto.news/crypto-loses-768m-in-worst-hack-month-of-2026/",
   "publisher": "crypto.news",
   "date": "2026-10-01"
  },
  {
   "kind": "news",
   "title": "Bitget, Liquid exploits push Q3 crypto hacks toward $1.2B",
   "url": "https://cointelegraph.com/news/bitget-liquid-exploits-push-crypto-hacks-near-12b-q3",
   "publisher": "Cointelegraph",
   "date": "2026-10-15"
  }
 ],
 "indicators": {
  "domains": [],
  "addresses": []
 },
 "brief": "## Am I affected?\nBitget account holders: the theft hit the exchange's own hot and warm wallets, and reports say the loss was covered by Bitget's protection fund. Self-custody wallets were not touched.\n\n## What to do now\n- Check your balance only by logging in through the app or bookmarked site you normally use.\n- Ignore emails, DMs, ads or posts offering 'compensation claims', 'refunds' or 'wallet re-verification'. Never connect a wallet or enter a seed phrase to claim anything from an exchange.\n\n## How to avoid this\n- Keep only your active trading balance on any exchange and hold the rest in self-custody.\n- Turn on withdrawal-address allowlists and app-based 2FA, and bookmark the official site.",
 "notes": null,
 "agentBrief": "# Bitget hot and warm wallets drained of $387.5M after zero-day in third-party security appliances\n\n- Severity: Critical · Status: Contained (live)\n- Chains: Ethereum, Arbitrum, Avalanche, Optimism, BNB Chain, Base\n- Started: Sep 24, 2026 · Last update: Oct 15, 2026 · Reported stolen: $388M\n- Who/what: Bitget exchange hot and warm wallets\n\nAttackers exploited a zero-day in two third-party security appliances at exchange Bitget, moved on to its production wallet job server and used a custom withdrawal tool to drain hot and warm wallets on 24-25 September 2026. The confirmed loss is about $387.5 million (first reported as $351.6M) across Ethereum, Arbitrum, Avalanche, Optimism, BSC, Base and the XRP Ledger. Bitget's CEO blamed North Korean hackers, and Bitget said cold wallets and private keys were not compromised. Hacken's Q3 figures say about $387M was covered by Bitget's user protection fund.\n\n## Am I affected?\nBitget account holders: the theft hit the exchange's own hot and warm wallets, and reports say the loss was covered by Bitget's protection fund. Self-custody wallets were not touched.\n\n## What to do now\n- Check your balance only by logging in through the app or bookmarked site you normally use.\n- Ignore emails, DMs, ads or posts offering 'compensation claims', 'refunds' or 'wallet re-verification'. Never connect a wallet or enter a seed phrase to claim anything from an exchange.\n\n## How to avoid this\n- Keep only your active trading balance on any exchange and hold the rest in self-custody.\n- Turn on withdrawal-address allowlists and app-based 2FA, and bookmark the official site.\n\n## Sources\n- Bitget hacked via zero-day in third-party security products (BleepingComputer, 2026-09-30): https://www.bleepingcomputer.com/news/security/bitget-hacked-via-zero-day-in-third-party-security-products/\n- Bitget resumes Bitcoin withdrawals after $387.5 million crypto heist (BleepingComputer, 2026-09-28): https://www.bleepingcomputer.com/news/security/bitget-resumes-bitcoin-withdrawals-after-3875-million-crypto-heist/\n- Crypto loses $768M in worst hack month of 2026 (crypto.news, 2026-10-01): https://crypto.news/crypto-loses-768m-in-worst-hack-month-of-2026/\n- Bitget, Liquid exploits push Q3 crypto hacks toward $1.2B (Cointelegraph, 2026-10-15): https://cointelegraph.com/news/bitget-liquid-exploits-push-crypto-hacks-near-12b-q3\n\nFull record: https://drains.watch/i/bitget-hot-wallet-breach-zero-day-sep-2026 · JSON: https://drains.watch/i/bitget-hot-wallet-breach-zero-day-sep-2026.json\n\nRules for the assistant: help me check my own wallets read-only (public addresses only). Never ask for or handle a seed phrase or private key. Point me to official revoke tools and the wallet's own support."
}