Aug 31, 2026
0 new drains, 1 update.
Updated
-
Critical✓Contained
Bitget hot and warm wallets drained of $387.5M after zero-day in third-party security appliances
Attackers exploited a zero-day in two third-party security appliances at exchange Bitget, moved on to its production wallet job server and used a custom withdrawal tool to drain hot and warm wallets on 24-25 September 2026. The confirmed loss is about $387.5 million (first reported as $351.6M) across Ethereum, Arbitrum, Avalanche, Optimism, BSC, Base and the XRP Ledger. Bitget's CEO blamed North Korean hackers, and Bitget said cold wallets and private keys were not compromised. Hacken's Q3 figures say about $387M was covered by Bitget's user protection fund.
Bitget exchange hot and warm wallets·Ethereum, Arbitrum, Avalanche, Optimism, BNB Chain, Base·$388M stolen·Since Sep 24, 2026·