VulnHub

Real-time Cybersecurity News

Critical

Bitget Says Suspected North Korean Hackers Stole $351.6M After Backend Compromise

The Hacker News
Actively Exploited

Overview

Bitget, a cryptocurrency exchange, reported that suspected North Korean hackers stole $351.6 million from its hot and warm wallets. The unauthorized transfers were detected on September 24, 2026, at 18:31 UTC, when Bitget's security systems flagged the activity. While the hot wallets were compromised, the exchange reassured users that its cold wallets and most of its assets remain secure. This incident raises concerns about the security of cryptocurrency exchanges, especially given the involvement of state-sponsored actors. The theft further emphasizes the need for enhanced security measures in the crypto space as attacks from sophisticated groups continue to pose significant risks.

Key Takeaways

  • Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
  • Affected Systems: Bitget cryptocurrency exchange hot and warm wallets
  • Action Required: Users are advised to monitor their accounts and secure their assets.
  • Timeline: Disclosed on September 24, 2026

Original Article Summary

Cryptocurrency exchange Bitget said suspected North Korean threat actors have stolen $351.6 million from its hot and warm wallets. "At 18:31 UTC on September 24, 2026, Bitget's security systems identified unauthorized transfers involving a limited number of hot wallets," BitGet said in a post shared on X. "Bitget's cold wallets and the overwhelming majority of platform assets remain

Impact

Bitget cryptocurrency exchange hot and warm wallets

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Disclosed on September 24, 2026

Remediation

Users are advised to monitor their accounts and secure their assets. Bitget's cold wallets remain unaffected, indicating a need for users to consider cold storage for their holdings.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Read Original Article

Related Coverage

In Other News: Clop Leak Site Takeover, Docker Botnet Hunts AI Keys, Water Utility Exposure

SecurityWeek

Recent cybersecurity incidents include a takeover of the Clop leak site, which has been used to leak sensitive information from various organizations. Additionally, a botnet targeting Docker containers has emerged, specifically hunting for AI keys, which could potentially lead to unauthorized access to AI systems. There is also a newly discovered flaw in TDengine that threatens the uptime of industrial telemetry systems. In the open-source community, a significant update overhaul for Ubuntu is being rolled out, addressing multiple vulnerabilities. These incidents reflect ongoing risks to both personal and industrial systems, highlighting the need for vigilant security practices among users and organizations alike.

Sep 25, 2026

With the Rise of AI Agents, SOC 2 Should Adapt or Risk Irrelevance

BleepingComputer

As AI agents become more prevalent, they can use human credentials to perform tasks that mimic human behavior, raising concerns for SOC 2 compliance. Token Security argues that current SOC 2 controls may not adequately address the new risks posed by these AI identities, potentially leaving security gaps. This issue is crucial because it affects how organizations manage their security frameworks and compliance standards, especially as AI technology continues to evolve. Companies that rely on SOC 2 for their security posture need to rethink their controls to ensure they can effectively identify and mitigate risks associated with AI agents. Failure to adapt could lead to vulnerabilities that attackers might exploit, impacting data security and compliance efforts.

Sep 25, 2026

Stopping IT Worker Scams Requires Revamped HR Process

darkreading

The article discusses the growing issue of IT worker scams, which target companies by exploiting weaknesses in their hiring processes. It emphasizes the importance of training human-resource managers to recognize the latest tactics used by scammers, such as phishing and social engineering. Additionally, the piece advocates for the use of automated analysis tools to enhance the detection of potential fraud. By improving HR processes and integrating technology, organizations can better protect themselves from these scams, which can lead to significant financial losses and reputational damage. This is particularly crucial as the number of incidents continues to rise, making it imperative for companies to stay ahead of these threats.

Sep 25, 2026

Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware

The Hacker News

Two GitHub Actions repositories, actions-cool/issues-helper and actions-cool/maintain-one-comment, were recently disabled after they were found to be compromised. This incident follows a previous breach during the Mini Shai-Hulud campaign in May 2026. The repositories were briefly accessible again, which allowed the execution of malware before being taken offline. Users who relied on these actions for their projects could be at risk of having their systems compromised. GitHub's swift action to disable the repositories underscores the ongoing challenges of securing open-source tools and the importance of vigilance among developers.

Sep 25, 2026

CISA Election Security Plan Flags Patching Barriers, Voter Database Attacks

SecurityWeek

The Cybersecurity and Infrastructure Security Agency (CISA) has identified significant challenges in the security of election systems through a new plan commissioned by Homeland Security Secretary Markwayne Mullin. This plan flags issues like barriers to timely software patching and potential attacks on voter databases. These vulnerabilities could jeopardize the integrity of elections, making it crucial for election officials to address them proactively. CISA's focus on these areas underscores the need for improved cybersecurity measures as elections approach, ensuring that voter information remains secure and systems are up-to-date. The implications of not addressing these concerns could lead to compromised voter data and disrupted electoral processes.

Sep 25, 2026

Your LG TV is constantly collecting your data – here’s how to stop it

news – ZDNET

The article discusses privacy concerns surrounding LG TVs, which are reportedly collecting user data continuously. Users may not be aware that their viewing habits and other information are logged by the device. The only way to erase certain data logs from the TV's hardware is to perform a factory reset. This situation raises significant privacy issues, especially for users who may not be comfortable with their data being collected without explicit consent. To protect their privacy, LG TV owners should consider this reset as a necessary step to limit data collection.

Sep 25, 2026