Bitget's $388 million theft ran on legitimate admin credentials through a third-party security product
Attackers exploited a zero-day in an unnamed security product Bitget used, reached an internal management system, and inserted withdrawal commands while posing as administrators. Private keys were never touched; they did not need to be.
The cryptocurrency exchange Bitget said on September 28 that the attacker who stole about $388 million on September 24 got in through a zero-day in a third-party security product the exchange used. The flaw gave access to an internal management system, from which the attacker inserted fraudulent withdrawal commands into backend wallet services from hot and warm wallets. Chief executive Gracy Chen said the attackers used legitimate credentials, posed as administrators, and removed traces of their actions. Two small test transfers at 18:31 UTC stayed below alert thresholds before larger transfers about 30 minutes later. Bitget says private keys were not compromised and cold wallets were unaffected. It has not named the product or said whether a fix exists. Bitget suspects North Korean attackers; TRM Labs found overlaps with the TraderTraitor group without a firm attribution.
Why it matters
"The private keys were safe" is the least reassuring sentence in the disclosure. The keys did not need to leave, because the management plane could instruct the wallet service to sign, and anyone holding an administrator's credentials in that plane could issue the instruction. The control that failed is separation of duties: withdrawal authorization lived in the same trust domain as administrative access, so compromising one gave you the other. Bitget has since added independent withdrawal checks, which is the right fix and the one to verify you already have: a high-value action approved through a separate channel that the admin session cannot reach.
The entry point deserves the same attention it got at Cisco FMC and Cisco ISE this month. Security products run with broad access and are trusted by the systems around them, which makes them privileged identity infrastructure whether or not they are inventoried that way. The test transfers under the alert threshold are the detection lesson: thresholds tuned to amounts miss an attacker who is checking whether the pipe works. See zero standing privileges.
Source: The Hacker News
Related on Start with Identity
- BlogGyazo breach exposes 23.6 million accounts, including session IDs and X integration tokens
An attacker reached Gyazo's database through its image upload server and took 23.62 million user records: emails, password hashes, login session IDs, device IDs
- BlogShinyHunters claims an Ernst & Young breach that started with someone else's stolen credentials
The extortion group says it used credentials obtained through a supply-chain attack, source undisclosed, to reach EY's Jira, GitHub, and Azure environments, and
- BlogAbbott investigates two incidents, one starting with a vished Entra account
Abbott confirmed unauthorized access to legacy Exact Sciences systems after a mid-June vishing attack compromised a Microsoft Entra single sign-on account. Shin
- ArticleThird-Party Access Management: Governing Vendor, Contractor, and Partner Identities
A complete guide to managing external identities, from vendor access governance and B2B federation to contractor lifecycle management and external identity risk
- ArticleB2B SaaS Security Tools: The Stack That Gets You Through Enterprise Procurement
The security tooling a B2B SaaS product actually needs to close enterprise deals in 2026, from enterprise SSO and SCIM to audit logs, secrets scanning, and acce
- GlossaryClient Credentials Grant
An OAuth 2.0 flow where an application authenticates as itself, with no user present, to obtain an access token. The standard pattern for machine-to-machine acc