Bitget hack: $387.5 million taken through compromised security appliances

What happened

Bitget says about $387.5 million was taken from its hot and warm wallets on 24 September 2026, in XRP, ETH, USDT, ZEC, USDC, USDT0, XAUt, BNB, AVAX and TRX. Mandiant's status report of 28 September and SlowMist's progress report as of 29 September trace the intrusion through two third-party security appliances: a web shell on one, then a move to Bitget's production wallet job server, where a custom withdrawal tool forged risk-control parameters.

The loss field carries Bitget's own figure from its 25 September notice, which raised its first estimate of $351.6 million to about $387.5 million after adding transfers on Zcash and TRON; its public tracing dashboard counted $390.05 million at prices from the time of the theft. Mandiant's report says the attacker gained privileged access to third-party security appliances A and B, deployed a web shell on appliance B, moved laterally to the production wallet job server and deployed malicious packages there; Bitget observed no evidence of private-key compromise, and its cold wallets were unaffected. SlowMist dates the earliest malicious activity in the available logs to 31 August, through a zero-day in a service on one of the security products, and recovered from deleted files a highly customised withdrawal tool that forged risk-control parameters. The earliest verified transfer came at 18:31:00 UTC on 24 September, 93 TRX, and the transfers ran to 21:23:11 UTC, about 2 hours and 52 minutes. YFarmX measured 16 original receipts on six Ethereum-compatible chains plus three XRP receipts totalling 102,976,680.091945 XRP, together about $350.66 million at the 24 September 21:39:35 UTC valuation reference, and dated holdings snapshots locate about $348.30 million, combining EVM observations at 23:35–23:44 UTC on 24 September with XRP at 00:05:42 UTC on 25 September; located holdings are distinct from recoveries. Bitget suspects North Korean attackers, Fortune reported on 25 September. Twelve later XRP payments named three Ethereum destinations in Bridgers memos, and those destinations received 19.003612 ETH, about $51,150 at Chainlink's $2,691.41, from the SwftSwap-labelled contract by 01:08:23 UTC on 25 September. Bitget's 25 September notice offers a recovery bounty of 5% of any funds frozen through a person's or firm's voluntary action. On 30 September Bitget said its Protection Fund, which covers the loss, had been refilled to more than $300 million. Bitget’s dated incident timeline records USDT withdrawals resuming on 30 September and the remaining cryptocurrencies, fiat and P2P services resuming on 2 October at 08:00 UTC.