Bitget Hot-Wallet Theft Linked to Zero-Day Vulnerability

• •Bitget's hot-wallet theft involved a zero-day vulnerability and insider credential exploitation.
• •Attackers accessed both hot and warm wallets after compromising third-party security devices.
• •The incident highlights significant risks from third-party software in cryptocurrency security.

On September 25, 2026, Bitget's hot-wallet theft was traced to a zero-day vulnerability in a third-party security product, as reported by SlowMist. Attackers exploited internal employee credentials to access the management platform, manipulating withdrawal records and stealing funds across multiple blockchains within a three-hour window. Mandiant's investigation indicated that the attackers first compromised third-party security devices on September 24 before accessing Bitget's hot and warm wallets. The incident raises significant concerns about the security of external systems linked to cryptocurrency exchanges. The investigation into the breach is ongoing, focusing on the attackers' lateral movements within the systems. This incident emphasizes the risks associated with third-party software and insider threats in the crypto sector.