Skip to content

Back to the catalog

theblock.coarticle

Bitget starts phased withdrawal resumption following $388 million exploit

Bitget began phased withdrawal resumption after a 24 September 2026 exploit drained about $388M from its hot and warm wallets. The attacker used a vulnerability in a third-party security product to obtain internal credentials and send fraudulent withdrawal commands. Bitget says private keys, user balances and cold wallets were unaffected, and suspects North Korea. Mandiant and SlowMist are investigating; the report gives no technical detail on the flaw.

TL;DR Reports Bitget's staged withdrawal restart after a $388M hot-wallet theft via a third-party security product, with suspected North Korean involvement.
Open original ↗

Organisations named here

  • Bitget
  • Mandiant
  • SlowMist

Technologies named here

  • Bitget hot wallets
  • Mandiant
  • SlowMist
  • Bitget warm wallets
  • Unnamed third-party security product used by Bitget (vulnerability exploited to obtain internal credentials)
  • User Protection Fund

Techniques named here

  • Fraudulent withdrawal commands

Concepts named here

  • Bug bounty for fund recovery
  • Hot and warm wallet compromise
  • Third-party supply chain risk

Threat actors named here

  • North Korea
  • DPRK

Related in Threat Intel