Bitget Incident Analysis

Context

Starting at 18:31 UTC on 24 September 2026, about US$387.5 million left Bitget’s hot and warm wallets. Bitget says no private keys were compromised. Interim reports from SlowMist and Mandiant now show how the attack unfolded: a zero-day in a third-party security product gave the attacker a foothold, two security appliances were used to deploy malicious packages onto the production wallet job server, and a custom tool forged risk-control parameters so that Bitget’s own signers executed the withdrawals. SlowMist traces the earliest malicious activity to 31 August. Both investigations are ongoing and Bitget has not yet published its formal incident report, so this analysis labels each finding by its basis: forensic reports, on-chain records, Bitget statements, third-party research, or our own analysis. It will be updated as further findings are published.

Key takeaways

1. 1The signers worked as designed, and that was the problem. A custom tool on the wallet job server forged risk-control parameters and built withdrawal requests, and Bitget’s own signers signed them. Everything between a system asking for a transfer and the signer signing depended on the systems around the signer being trustworthy, including two security appliances. Certifications focused on key custody would not have covered this trust boundary, so signers should accept a transfer only when it matches an independent withdrawal record or carries a cryptographic signature from the originating service.
2. 2The larger detection gap came before the theft. SlowMist finds malicious activity from 31 August, and the attacker was abusing a security appliance’s management platform more than two hours before the first transfer. Once transfers began, reconciliation flagged them within seven minutes, but the block covered only user-initiated withdrawals, so the warm-wallet wave, more than half of the loss, was signed 11 minutes later. A single emergency stop at the signer would in our assessment have limited the loss to roughly the first wave.
3. 3Security appliances belong inside the wallet trust tier. Neither report names the two products, so other customers may still be exposed and should look back to at least mid-August. The incident is the latest in a series in which a trusted provider or tool with privileged reach was compromised, and moderate to strong evidence points to the same DPRK cluster attributed for Bybit and DMM Bitcoin. Exposure to such tools drives how often an attack can happen; what sits between a command and a signature drives how much it costs.

Contributors

• Rex ZhangOneInfinity
• Daky Wang
• Rick Lin

References

• Mandiant: Bitget Incident Response Status Report (opens in a new tab)
• SlowMist: Investigation Progress Report – Bitget (opens in a new tab)