{
 "tag": "hot-wallet",
 "name": "Hot Wallet",
 "group": "Other",
 "incidents": [
  {
   "slug": "bitget-hot-wallet-breach-zero-day-sep-2026",
   "title": "Bitget hot and warm wallets drained of $387.5M after zero-day in third-party security appliances",
   "url": "https://drains.watch/i/bitget-hot-wallet-breach-zero-day-sep-2026",
   "json": "https://drains.watch/i/bitget-hot-wallet-breach-zero-day-sep-2026.json",
   "status": "live",
   "severity": "critical",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "ethereum",
    "arbitrum",
    "avalanche",
    "optimism",
    "bsc",
    "base"
   ],
   "method": null,
   "product": "Bitget exchange hot and warm wallets",
   "tags": [
    "ethereum",
    "arbitrum",
    "avalanche",
    "optimism",
    "bsc",
    "base",
    "exchange",
    "bitget",
    "hot-wallet",
    "zero-day",
    "infrastructure-breach",
    "dprk"
   ],
   "amountUsd": 387500000,
   "victims": null,
   "startedAt": "2026-09-24",
   "closedAt": "2026-09-28",
   "updatedAt": "2026-10-15T12:00:00Z",
   "summary": "Attackers exploited a zero-day in two third-party security appliances at exchange Bitget, moved on to its production wallet job server and used a custom withdrawal tool to drain hot and warm wallets on 24-25 September 2026. The confirmed loss is about $387.5 million (first reported as $351.6M) across Ethereum, Arbitrum, Avalanche, Optimism, BSC, Base and the XRP Ledger. Bitget's CEO blamed North Korean hackers, and Bitget said cold wallets and private keys were not compromised. Hacken's Q3 figures say about $387M was covered by Bitget's user protection fund."
  },
  {
   "slug": "duelbits-hot-wallet-drain-sep-2026",
   "title": "Crypto casino Duelbits loses about $7M from hot wallets in suspected private-key compromise",
   "url": "https://drains.watch/i/duelbits-hot-wallet-drain-sep-2026",
   "json": "https://drains.watch/i/duelbits-hot-wallet-drain-sep-2026.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "ethereum",
    "bsc",
    "tron",
    "bitcoin",
    "solana"
   ],
   "method": "key-leak",
   "product": "Duelbits crypto casino hot wallets",
   "tags": [
    "ethereum",
    "bsc",
    "tron",
    "bitcoin",
    "solana",
    "key-leak",
    "casino",
    "gambling",
    "hot-wallet",
    "private-key-compromise",
    "duelbits"
   ],
   "amountUsd": 7000000,
   "victims": null,
   "startedAt": "2026-09-24",
   "closedAt": "2026-09-27",
   "updatedAt": "2026-10-06T12:00:00Z",
   "summary": "On 24 September 2026 crypto casino Duelbits had hot wallets drained across Ethereum, BNB Chain, Tron, Bitcoin and Solana. Co-founder Joe called it a hack of about $7M; other estimates run from about $4.2M (Scam Sniffer, early) to about $6M (CertiK), and Rekt traced about $6.07M. Scam Sniffer and SlowMist point to a leaked private key, but Duelbits has not published a root cause. The site reopened on 27 September and said user funds were safe."
  },
  {
   "slug": "triple-a-hot-wallets-drained-jul-2026",
   "title": "Crypto payments firm Triple-A loses $9.7M+ from hot wallets on Ethereum, Solana, TRON and TON",
   "url": "https://drains.watch/i/triple-a-hot-wallets-drained-jul-2026",
   "json": "https://drains.watch/i/triple-a-hot-wallets-drained-jul-2026.json",
   "status": "live",
   "severity": "critical",
   "threatStatus": "partly-contained",
   "verification": "verified",
   "chains": [
    "solana",
    "ethereum",
    "tron"
   ],
   "method": null,
   "product": "Triple-A payment processor hot wallets",
   "tags": [
    "solana",
    "ethereum",
    "tron",
    "payments",
    "hot-wallet",
    "treasury",
    "triple-a",
    "multi-chain",
    "peckshield"
   ],
   "amountUsd": 9700000,
   "victims": null,
   "startedAt": "2026-07-24",
   "closedAt": null,
   "updatedAt": "2026-07-25T12:00:00Z",
   "summary": "On Jul 24, 2026, on-chain analyst Specter flagged suspicious outflows from hot wallets of the crypto payment processor Triple-A, and PeckShield later estimated losses above $9.7 million. crypto.news lists Ethereum, Solana, TRON and TON as affected, with some reports adding Polygon and Arbitrum. The proceeds were gathered in an Ethereum address holding about 5,227 ETH. The cause had not been disclosed, and no evidence tied the breach to Triple-A's custody provider Fireblocks. Merchants and customers should rely only on Triple-A's official channels for updates."
  },
  {
   "slug": "upbit-solana-hot-wallet-hack-nov-2025",
   "title": "Upbit loses about $36M as Solana hot wallet is drained; Lazarus suspected",
   "url": "https://drains.watch/i/upbit-solana-hot-wallet-hack-nov-2025",
   "json": "https://drains.watch/i/upbit-solana-hot-wallet-hack-nov-2025.json",
   "status": "closed",
   "severity": "critical",
   "threatStatus": "contained",
   "verification": "verified",
   "chains": [
    "solana"
   ],
   "method": null,
   "product": "Upbit exchange Solana hot wallet",
   "tags": [
    "solana",
    "exchange",
    "cex",
    "hot-wallet",
    "upbit",
    "lazarus",
    "north-korea"
   ],
   "amountUsd": 36000000,
   "victims": null,
   "startedAt": "2025-11-27",
   "closedAt": "2025-11-27",
   "updatedAt": "2025-11-28T12:00:00Z",
   "summary": "On Nov 27, 2025, South Korea's largest exchange Upbit disclosed irregular withdrawals that drained roughly $36 million in Solana-network tokens from a hot wallet. Upbit froze the affected wallets, moved remaining funds to cold storage, said cold wallets were not breached and pledged to reimburse customers in full. South Korean authorities suspect North Korea's Lazarus Group, according to Yonhap, and CertiK said it tracked over 100 exploiter addresses on Solana. How the attackers got signing access has not been explained publicly. Customers did not need to act, but should treat any 'Upbit refund' message as phishing."
  }
 ],
 "changes": [
  {
   "incident": "bitget-hot-wallet-breach-zero-day-sep-2026",
   "incidentTitle": "Bitget hot and warm wallets drained of $387.5M after zero-day in third-party security appliances",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-10-15",
   "title": "Hacken's Q3 data showed about $387M covered by Bitget's user protection fund; Circle and Tether froze about $340,000 tied to the theft.",
   "sourceUrl": "https://cointelegraph.com/news/bitget-liquid-exploits-push-crypto-hacks-near-12b-q3",
   "url": "https://drains.watch/i/bitget-hot-wallet-breach-zero-day-sep-2026"
  },
  {
   "incident": "duelbits-hot-wallet-drain-sep-2026",
   "incidentTitle": "Crypto casino Duelbits loses about $7M from hot wallets in suspected private-key compromise",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-10-06",
   "title": "Rekt reported that no root-cause report had been published, traced about $6.07M, and noted an earlier $4.6M Duelbits hot-wallet breach in February 2024.",
   "sourceUrl": "https://rekt.news/duelbits-rekt",
   "url": "https://drains.watch/i/duelbits-hot-wallet-drain-sep-2026"
  },
  {
   "incident": "bitget-hot-wallet-breach-zero-day-sep-2026",
   "incidentTitle": "Bitget hot and warm wallets drained of $387.5M after zero-day in third-party security appliances",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-10-01",
   "title": "The confirmed loss was put at $387.5 million, up from the first estimate of $351.6 million.",
   "sourceUrl": "https://crypto.news/crypto-loses-768m-in-worst-hack-month-of-2026/",
   "url": "https://drains.watch/i/bitget-hot-wallet-breach-zero-day-sep-2026"
  },
  {
   "incident": "bitget-hot-wallet-breach-zero-day-sep-2026",
   "incidentTitle": "Bitget hot and warm wallets drained of $387.5M after zero-day in third-party security appliances",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-09-28",
   "title": "Bitget resumed Bitcoin withdrawals.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/bitget-resumes-bitcoin-withdrawals-after-3875-million-crypto-heist/",
   "url": "https://drains.watch/i/bitget-hot-wallet-breach-zero-day-sep-2026"
  },
  {
   "incident": "duelbits-hot-wallet-drain-sep-2026",
   "incidentTitle": "Crypto casino Duelbits loses about $7M from hot wallets in suspected private-key compromise",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-09-27",
   "title": "Duelbits reopened at 05:04 UTC with deposits and withdrawals enabled.",
   "sourceUrl": "https://rekt.news/duelbits-rekt",
   "url": "https://drains.watch/i/duelbits-hot-wallet-drain-sep-2026"
  },
  {
   "incident": "bitget-hot-wallet-breach-zero-day-sep-2026",
   "incidentTitle": "Bitget hot and warm wallets drained of $387.5M after zero-day in third-party security appliances",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-09-25",
   "title": "A custom withdrawal tool drained hot and warm wallets over nearly three hours after midnight (UTC+8); Bitget suspended withdrawals.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/bitget-hacked-via-zero-day-in-third-party-security-products/",
   "url": "https://drains.watch/i/bitget-hot-wallet-breach-zero-day-sep-2026"
  },
  {
   "incident": "bitget-hot-wallet-breach-zero-day-sep-2026",
   "incidentTitle": "Bitget hot and warm wallets drained of $387.5M after zero-day in third-party security appliances",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-09-24",
   "title": "Per Mandiant, the attacker gained privileged access to two third-party security appliances, then reached the wallet job server and deployed malicious packages.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/bitget-hacked-via-zero-day-in-third-party-security-products/",
   "url": "https://drains.watch/i/bitget-hot-wallet-breach-zero-day-sep-2026"
  },
  {
   "incident": "duelbits-hot-wallet-drain-sep-2026",
   "incidentTitle": "Crypto casino Duelbits loses about $7M from hot wallets in suspected private-key compromise",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2026-09-24",
   "title": "Duelbits hot wallets were drained across five chains; Scam Sniffer called it a suspected private-key compromise and SlowMist listed private key leakage.",
   "sourceUrl": "https://rekt.news/duelbits-rekt",
   "url": "https://drains.watch/i/duelbits-hot-wallet-drain-sep-2026"
  },
  {
   "incident": "bitget-hot-wallet-breach-zero-day-sep-2026",
   "incidentTitle": "Bitget hot and warm wallets drained of $387.5M after zero-day in third-party security appliances",
   "severity": "critical",
   "status": "live",
   "threatStatus": "contained",
   "date": "2026-08-31",
   "title": "SlowMist's report traced the earliest malicious activity in Bitget's logs to 31 August.",
   "sourceUrl": "https://www.bleepingcomputer.com/news/security/bitget-hacked-via-zero-day-in-third-party-security-products/",
   "url": "https://drains.watch/i/bitget-hot-wallet-breach-zero-day-sep-2026"
  },
  {
   "incident": "triple-a-hot-wallets-drained-jul-2026",
   "incidentTitle": "Crypto payments firm Triple-A loses $9.7M+ from hot wallets on Ethereum, Solana, TRON and TON",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-07-25",
   "title": "PeckShield amplified the alert as estimates rose above $9.7M; Triple-A had not yet confirmed the breach.",
   "sourceUrl": "https://crypto.news/triple-a-hot-wallets-lose-9-7m-in-suspected-exploit/",
   "url": "https://drains.watch/i/triple-a-hot-wallets-drained-jul-2026"
  },
  {
   "incident": "triple-a-hot-wallets-drained-jul-2026",
   "incidentTitle": "Crypto payments firm Triple-A loses $9.7M+ from hot wallets on Ethereum, Solana, TRON and TON",
   "severity": "critical",
   "status": "live",
   "threatStatus": "partly-contained",
   "date": "2026-07-24",
   "title": "Analyst Specter flagged suspicious transfers from Triple-A hot wallets, first estimated at over $9.3M.",
   "sourceUrl": "https://crypto.news/triple-a-hot-wallets-lose-9-7m-in-suspected-exploit/",
   "url": "https://drains.watch/i/triple-a-hot-wallets-drained-jul-2026"
  },
  {
   "incident": "upbit-solana-hot-wallet-hack-nov-2025",
   "incidentTitle": "Upbit loses about $36M as Solana hot wallet is drained; Lazarus suspected",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-11-28",
   "title": "Yonhap reported that South Korean authorities suspect the Lazarus Group and are preparing an on-site probe; CertiK said it tracked over 100 exploiter addresses.",
   "sourceUrl": "https://decrypt.co/350303/upbit-hack-north-koreas-lazarus-seoul-opens-probe",
   "url": "https://drains.watch/i/upbit-solana-hot-wallet-hack-nov-2025"
  },
  {
   "incident": "upbit-solana-hot-wallet-hack-nov-2025",
   "incidentTitle": "Upbit loses about $36M as Solana hot wallet is drained; Lazarus suspected",
   "severity": "critical",
   "status": "closed",
   "threatStatus": "contained",
   "date": "2025-11-27",
   "title": "Upbit disclosed irregular withdrawals that drained about $36M in multiple Solana tokens from a hot wallet, froze the wallets and moved remaining funds to cold storage.",
   "sourceUrl": "https://decrypt.co/350303/upbit-hack-north-koreas-lazarus-seoul-opens-probe",
   "url": "https://drains.watch/i/upbit-solana-hot-wallet-hack-nov-2025"
  }
 ]
}