Bitget disclosed that an attacker stole approximately $388 million by exploiting a vulnerability in a third-party security product integrated into the exchange's infrastructure. The threat actor used the flaw to obtain high-level internal credentials, which were subsequently used on September 24 to issue fraudulent withdrawal commands to Bitget's wallet system. The exchange confirmed that most user funds remain secure, though the full extent of exposure is under investigation.

Which products are affected?

third-party security product (specific name unverified)

What should defenders do?

Bitget and the third-party security product vendor have not yet released official patches or advisories. Organizations should monitor official communications from Bitget and the security product vendor for patch releases. Implementing strict credential rotation, network segmentation, and rigorous access controls for third-party integrations is recommended until further information is available.

highCyber Attacks

Bitget Reports $388M Loss Following Exploitation of Third-Party Security Product Flaw

Attacker Gained Internal Credentials via Vulnerability, Sent Fraudulent Withdrawal Commands

CyberIntel DeskPublished about 6 hours agoUpdated less than a minute ago1 min read

Bitget Reports $388M Loss Following Exploitation of Third-Party Security Product Flaw

Key Takeaways

Bitget reports a loss of approximately $388 million due to an exploit of a third-party security product.
The attacker obtained high-level internal credentials through the exploited flaw.
Fraudulent withdrawal commands were issued on September 24, targeting the wallet system.
Bitget states that most user funds are stored offline and remain secure.

Related Security News

highCyber Attacks

Former US Air Force Members Sentenced to Prison for Business Email Compromise Scams

Two former members of the United States Air Force were sentenced to a combined 189 months in federal prison for their roles in a multi-year series of business email compromise (BEC) scams and phishing campaigns. The sentencing, reported by BleepingComputer in September 2026, concluded a federal case targeting individuals who abused their military backgrounds to conduct financially motivated email fraud. The attacks spanned multiple years prior to sentencing, though specific victim counts and total financial losses were not detailed in the reporting. The case underscores the legal consequences of using military credentials and training for cyber-enabled fraud.

BleepingComputerabout 5 hours ago1 min read