{
 "tag": "exchange",
 "name": "Exchange",
 "group": "Other",
 "incidents": [
  {
   "slug": "bitget-hot-wallet-breach-zero-day-sep-2026",
   "title": "Bitget hot and warm wallets drained of $387.5M after zero-day in third-party security appliances",
   "url": "https://drains.watch/i/bitget-hot-wallet-breach-zero-day-sep-2026",
   "json": "https://drains.watch/i/bitget-hot-wallet-breach-zero-day-sep-2026.json",
   "status": "live",
   "severity": "critical",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "ethereum",
    "arbitrum",
    "avalanche",
    "optimism",
    "bsc",
    "base"
   ],
   "method": null,
   "product": "Bitget exchange hot and warm wallets",
   "tags": [
    "ethereum",
    "arbitrum",
    "avalanche",
    "optimism",
    "bsc",
    "base",
    "exchange",
    "bitget",
    "hot-wallet",
    "zero-day",
    "infrastructure-breach",
    "dprk"
   ],
   "amountUsd": 387500000,
   "victims": null,
   "startedAt": "2026-09-24",
   "closedAt": "2026-09-28",
   "updatedAt": "2026-10-15T12:00:00Z",
   "summary": "Attackers exploited a zero-day in two third-party security appliances at exchange Bitget, moved on to its production wallet job server and used a custom withdrawal tool to drain hot and warm wallets on 24-25 September 2026. The confirmed loss is about $387.5 million (first reported as $351.6M) across Ethereum, Arbitrum, Avalanche, Optimism, BSC, Base and the XRP Ledger. Bitget's CEO blamed North Korean hackers, and Bitget said cold wallets and private keys were not compromised. Hacken's Q3 figures say about $387M was covered by Bitget's user protection fund."
  },
  {
   "slug": "upbit-solana-hot-wallet-hack-nov-2025",
   "title": "Upbit loses about $36M as Solana hot wallet is drained; Lazarus suspected",
   "url": "https://drains.watch/i/upbit-solana-hot-wallet-hack-nov-2025",
   "json": "https://drains.watch/i/upbit-solana-hot-wallet-hack-nov-2025.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "solana"
   ],
   "method": null,
   "product": "Upbit exchange Solana hot wallet",
   "tags": [
    "solana",
    "exchange",
    "cex",
    "hot-wallet",
    "upbit",
    "lazarus",
    "north-korea"
   ],
   "amountUsd": 36000000,
   "victims": null,
   "startedAt": "2025-11-27",
   "closedAt": "2025-11-27",
   "updatedAt": "2025-11-28T12:00:00Z",
   "summary": "On Nov 27, 2025, South Korea's largest exchange Upbit disclosed irregular withdrawals that drained roughly $36 million in Solana-network tokens from a hot wallet. Upbit froze the affected wallets, moved remaining funds to cold storage, said cold wallets were not breached and pledged to reimburse customers in full. South Korean authorities suspect North Korea's Lazarus Group, according to Yonhap, and CertiK said it tracked over 100 exploiter addresses on Solana. How the attackers got signing access has not been explained publicly. Customers did not need to act, but should treat any 'Upbit refund' message as phishing."
  }
 ],
 "changes": [
  {
   "incident": "bitget-hot-wallet-breach-zero-day-sep-2026",
   "incidentTitle": "Bitget hot and warm wallets drained of $387.5M after zero-day in third-party security appliances",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-10-15",
   "title": "Hacken's Q3 data showed about $387M covered by Bitget's user protection fund; Circle and Tether froze about $340,000 tied to the theft.",
   "sourceUrl": "https://cointelegraph.com/news/bitget-liquid-exploits-push-crypto-hacks-near-12b-q3",
   "url": "https://drains.watch/i/bitget-hot-wallet-breach-zero-day-sep-2026"
  },
  {
   "incident": "bitget-hot-wallet-breach-zero-day-sep-2026",
   "incidentTitle": "Bitget hot and warm wallets drained of $387.5M after zero-day in third-party security appliances",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-10-01",
   "title": "The confirmed loss was put at $387.5 million, up from the first estimate of $351.6 million.",
   "sourceUrl": "https://crypto.news/crypto-loses-768m-in-worst-hack-month-of-2026/",
   "url": "https://drains.watch/i/bitget-hot-wallet-breach-zero-day-sep-2026"
  },
  {
   "incident": "bitget-hot-wallet-breach-zero-day-sep-2026",
   "incidentTitle": "Bitget hot and warm wallets drained of $387.5M after zero-day in third-party security appliances",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-09-28",
   "title": "Bitget resumed Bitcoin withdrawals.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/bitget-resumes-bitcoin-withdrawals-after-3875-million-crypto-heist/",
   "url": "https://drains.watch/i/bitget-hot-wallet-breach-zero-day-sep-2026"
  },
  {
   "incident": "bitget-hot-wallet-breach-zero-day-sep-2026",
   "incidentTitle": "Bitget hot and warm wallets drained of $387.5M after zero-day in third-party security appliances",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-09-25",
   "title": "A custom withdrawal tool drained hot and warm wallets over nearly three hours after midnight (UTC+8); Bitget suspended withdrawals.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/bitget-hacked-via-zero-day-in-third-party-security-products/",
   "url": "https://drains.watch/i/bitget-hot-wallet-breach-zero-day-sep-2026"
  },
  {
   "incident": "bitget-hot-wallet-breach-zero-day-sep-2026",
   "incidentTitle": "Bitget hot and warm wallets drained of $387.5M after zero-day in third-party security appliances",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-09-24",
   "title": "Per Mandiant, the attacker gained privileged access to two third-party security appliances, then reached the wallet job server and deployed malicious packages.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/bitget-hacked-via-zero-day-in-third-party-security-products/",
   "url": "https://drains.watch/i/bitget-hot-wallet-breach-zero-day-sep-2026"
  },
  {
   "incident": "bitget-hot-wallet-breach-zero-day-sep-2026",
   "incidentTitle": "Bitget hot and warm wallets drained of $387.5M after zero-day in third-party security appliances",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-08-31",
   "title": "SlowMist's report traced the earliest malicious activity in Bitget's logs to 31 August.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/bitget-hacked-via-zero-day-in-third-party-security-products/",
   "url": "https://drains.watch/i/bitget-hot-wallet-breach-zero-day-sep-2026"
  },
  {
   "incident": "upbit-solana-hot-wallet-hack-nov-2025",
   "incidentTitle": "Upbit loses about $36M as Solana hot wallet is drained; Lazarus suspected",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-11-28",
   "title": "Yonhap reported that South Korean authorities suspect the Lazarus Group and are preparing an on-site probe; CertiK said it tracked over 100 exploiter addresses.",
   "sourceUrl": "https://decrypt.co/350303/upbit-hack-north-koreas-lazarus-seoul-opens-probe",
   "url": "https://drains.watch/i/upbit-solana-hot-wallet-hack-nov-2025"
  },
  {
   "incident": "upbit-solana-hot-wallet-hack-nov-2025",
   "incidentTitle": "Upbit loses about $36M as Solana hot wallet is drained; Lazarus suspected",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-11-27",
   "title": "Upbit disclosed irregular withdrawals that drained about $36M in multiple Solana tokens from a hot wallet, froze the wallets and moved remaining funds to cold storage.",
   "sourceUrl": "https://decrypt.co/350303/upbit-hack-north-koreas-lazarus-seoul-opens-probe",
   "url": "https://drains.watch/i/upbit-solana-hot-wallet-hack-nov-2025"
  }
 ]
}