Bitget breach attributed to zero-day in third-party security products

Bitget, a major cryptocurrency exchange, revealed on September 30, 2026, that attackers exploited a zero-day vulnerability in third-party security products to breach its systems and steal approximately $387.5 million. The company stated that the attack occurred last week and that the vulnerability was present in security software integrated into its platform. BleepingComputer reported on the incident, noting that specific technical details, including the CVE identifier and the exact nature of the zero-day flaw, have not been disclosed. The exchange and the third-party security product vendors are reportedly working on patches and mitigations. No patch was available at the time of reporting. The full extent of the system compromise and any data exfiltration beyond the financial theft remains under investigation. Authorities and cybersecurity firms are likely examining logs and network traffic to determine the attack chain and attribution.