Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Bitget hit by cyberattack

Incident
First reported
Last updated
Happening score
H score 48
3 unique sources, 5 articles

Summary

Hide ▲

Bitget confirmed that attackers stole $387.5 million from its hot and warm wallets after exploiting a third-party zero-day in security products, forcing a temporary halt to withdrawals. SlowMist said the earliest malicious activity linked to the hack dates to August 31, 2026, while Mandiant found the attackers used access on security appliances to move laterally into Bitget’s wallet environment, deploy a web shell, and push malicious packages. Bitget says the incident is contained, user balances remain unaffected, and withdrawals are being restored in stages after remediation.

Related Happenings

Grinex hit by cyberattack

Incident
H score44 First: 17.04.2026 18:08 Last: 17.04.2026 18:08 Sources 1

About this happening: Grinex confirmed a hack that led it to suspend operations, with $13.7 million stolen and Russian users’ wallets affected. The incident matters because the exch...

Latest development: 20.04.2026 12:00

Grinex said a large-scale cyber-attack by foreign intelligence agencies forced it to suspend operations after one billion rubles ($13.2m) was stolen from Russian customers, and the exchange filed a criminal complaint and shared the destination crypto address with law enforcers. Chainalysis disputed the attribution, saying the exfiltrated funds were quickly swapped via a Tron-based decentralized exchange (DEX) into TRX, a pattern more consistent with criminal laundering or a possible false flag than a state-backed raid.

Open Happening

Drift Protocol hit by cyberattack

Incident
H score44 First: 02.04.2026 22:03 Last: 02.04.2026 22:03 Sources 1

About this happening: Drift Protocol disclosed a security-council takeover that drained at least $280 million and left its protocol functions essentially frozen. The attacker used durable...

Latest development: 06.04.2026 19:35

Elliptic and TRM Labs attributed the $280+ million theft from Drift Protocol to North Korean hackers, and Drift said its findings point with medium-high confidence to UNC4736 (AppleJeus/Labyrinth Chollima). The investigation also said the attackers spent at least six months building a functioning operational presence inside the Drift ecosystem, posing as a quantitative firm, meeting Drift contributors at crypto conferences in multiple countries, and continuing discussions over Telegram.

Open Happening

North Korean cryptocurrency theft campaign using social engineering

Campaign
H score34 First: 08.10.2025 14:09 Last: 08.10.2025 14:09 Sources 1

How related: Bitget, which last week pointed to North Korean hackers, still suspects "the same group of people," Chen told The Block.

About this happening: A North Korean cryptocurrency theft campaign now includes the Bitget theft, in which suspected North Korean hackers stole $351.6 million from hot and warm wallet...

Latest development: 28.09.2026 20:42

Bitget said an attacker exploited a third-party security product flaw to obtain high-level internal credentials and send fraudulent withdrawal commands to Bitget's wallet system on September 24; the attacker first made two small test transfers at 18:31 UTC, then larger transfers about 30 minutes later bypassed risk controls, and Bitget notified the vendor, isolated affected systems, revoked and reissued internal credentials, and turned off the affected functionality while the flaw is addressed.

Open Happening

Timeline

  1. 28.09.2026 20:42 3 articles · 13d ago

    Bitget attacker exploits third-party security product flaw for wallet access

    Technical Analysis Update

    Bitget said an attacker exploited a flaw in a third-party security product to obtain high-level internal credentials and then used them on September 24 to send fraudulent withdrawal commands to Bitget's wallet system. The attacker made two small test transfers at 18:31 UTC before larger transfers began about 30 minutes later and bypassed Bitget's risk controls. Bitget said it notified the vendor, isolated the affected systems, revoked and reissued internal credentials, and turned off the affected functionality while the vulnerability is addressed.

    Show sources
    Open in new tab
  2. 28.09.2026 18:00 1 articles · 13d ago

    Bitget reopens Bitcoin withdrawals after remediating wallet breach vulnerability

    Mitigation Patch Update

    Bitget reopened Bitcoin withdrawals at 08:00 UTC on September 28 after additional security checks, saying the vulnerability behind the wallet breach had been identified and remediated. The exchange said its investigation with Mandiant and SlowMist continued.

    Show sources
    Open in new tab
  3. 28.09.2026 12:25 2 articles · 13d ago

    Bitget hit by cyberattack

    Initial Disclosure

    Bitget first paused withdrawals after security systems flagged multiple unauthorized transfers from a limited number of wallets. The immediate response centered on stopping further outflows while investigators assessed compromised hot and warm wallet activity.

    Show sources
    Open in new tab