In the early hours of 25 September 2026 (UTC+8), cryptocurrency exchange Bitget detected unauthorized outbound transfers from part of its hot and warm wallet infrastructure. Mandiant, which Bitget engaged the same day, put Bitget's loss estimate between 351.6 and 387.5 million US dollars. Both Mandiant and SlowMist, the second firm investigating, trace the intrusion through two third-party security products that Bitget ran in its environment.
The tools that were meant to protect the network became the path into it.
What's affected
From Mandiant's status report dated 28 September:
- Detection: 02:31 local time (UTC+8) on 25 September, Bitget's monitoring detected unauthorized transfers. On Ethereum, they ran alongside legitimate wallet operations until about 05:23.
- Assets: XRP, ETH, USDT, USDC, BNB, AVAX, TRX, ZEC and Tether Gold, across multiple blockchains.
- Not affected: Bitget saw no evidence of private key compromise, and cold wallets were unaffected.
- Initial findings: On 24 September, the attacker gained unauthorized privileged access to Bitget's third-party security appliances, referred to as A and B. The attacker deployed a web shell on appliance B and set up a command and control connection.
- Lateral movement: From appliance B, the attacker moved to Bitget's production wallet job server and deployed malicious packages. Mandiant summarizes that the attacker compromised network and security appliances and used them to distribute malicious packages and gain control over the wallet job server.
From SlowMist's progress report as of 29 September:
- Earliest activity: 31 August, in available logs. A service on one of Product A's nodes was affected by a zero-day vulnerability. The attacker ran a hidden script under the service process, read an environment variable holding a database password and connected to the database. Similar activity appeared on two other nodes on 23 and 25 September.
- Product B: Early on 25 September, the attacker signed in to Product B's management platform using an internal employee's identity, tried three times to inject commands into task parameters, then submitted code through the platform's web execution endpoint.
- Theft tool: SlowMist recovered a customized withdrawal tool from deleted files. It forged risk control parameters and built withdrawal requests, and started running at 01:49 on 25 September.
Bitget has said the investigation found "malicious activity involving third-party security products, including a zero-day vulnerability," according to The Hacker News. It notified the vendor and disabled the affected functionality pending a fix. Neither the products nor the vendor have been publicly named.
How to check if you're exposed
The product names are not public, so you cannot match on a vendor. You can check whether your own security and network appliances could serve as the same kind of bridge.
- List every appliance and security product with a management interface. Firewalls, VPN gateways, EDR consoles, privileged access tools, WAFs, monitoring agents with remote execution. Note which can run commands or push files to other hosts.
- Check what secrets they hold in plain environment variables. SlowMist found the attacker read a database password from an environment variable. On Linux hosts you control:
# List processes whose environment contains likely secrets (run as root)
for p in /proc/[0-9]*; do
tr '\0' '\n' < "$p/environ" 2>/dev/null \
| grep -qiE 'pass|secret|token|key=' && echo "$(cat $p/comm) pid=${p#/proc/}"
done | sort -u
- Look for web shells on appliances that allow file access. Compare web roots and plugin folders against vendor baselines, and look for recently modified script files.
- Review which identities can use "run code" features. Product B's web execution endpoint was reached with an employee's identity. List who can execute tasks or scripts through each security console, and whether MFA is enforced.
- Map network paths from appliances to crown jewels. If a security appliance can reach your payment, wallet or production database servers, write down why.
What to do now
- Treat security products as high-value targets. Patch them on the same urgent schedule as internet-facing systems, and subscribe to each vendor's advisories.
- Disable remote execution features you do not use. Many management platforms ship with script execution or file push turned on. Turn off what you do not need.
- Move appliance secrets into a vault. Replace plain environment variable secrets with short-lived credentials fetched at runtime where the product allows it.
- Segment appliances from sensitive systems. A security tool's management plane should not have a direct network path to a wallet or payment server.
- Require phishing-resistant MFA on security consoles. Bind admin sessions to managed devices.
- Log appliance activity off the appliance. Ship management console and shell logs to a separate system. An attacker with root on the appliance can edit local logs.
Why it matters
Security products run with broad privileges by design. They inspect traffic, hold credentials and often can execute commands across many hosts. That makes them an efficient path for an attacker who finds a flaw in one.
The Bitget timeline also shows how long a foothold can sit. SlowMist's earliest log evidence is from 31 August, more than three weeks before the theft. Monitoring the monitors, with logs stored outside the appliance and alerts on unexpected command execution, is how you shorten that window.
Try it yourself
Pick one security product in your environment that has a management console. Find out who can sign in, whether MFA is enforced, whether it can run commands on other hosts, and where its logs go. If any answer surprises you, record it in your risk register with an owner.
Click through it at your own pace, or open it full screen.
Quick check
Were Bitget's private keys or cold wallets compromised?
Mandiant's status report says Bitget saw no evidence of private key compromise and its cold wallets were unaffected.
When does the earliest malicious activity date from?
SlowMist's report says 31 August 2026, in the logs available to it. Mandiant's report describes privileged access to the appliances on 24 September.
Have the third-party products been named?
No. Both reports refer to them only as A and B. Bitget says it notified the vendor and disabled the affected functionality pending a fix.
