Critical

Bitget Confirms Third-Party Zero-Day Behind $387.5 Million Cryptocurrency Theft

The Hacker News

October 1, 2026 at 5:21 AM

Actively Exploited

Overview

Bitget, a cryptocurrency exchange, reported a significant theft of $387.5 million that occurred last week. Investigations by SlowMist revealed that the attackers exploited a zero-day vulnerability in third-party security products. This flaw allowed the hackers to carry out their malicious activities undetected. Bitget is currently working to recover the stolen funds and mitigate further risks. This incident raises concerns about the security of third-party tools used by cryptocurrency exchanges and highlights the need for enhanced security measures to protect user assets in the digital currency space.

Key Takeaways

Active Exploitation: This vulnerability is being actively exploited by attackers. Immediate action is recommended.
Affected Systems: Bitget cryptocurrency exchange, third-party security products
Timeline: Disclosed on [date]

Original Article Summary

Cryptocurrency exchange Bitget on Wednesday confirmed that attackers who stole $387.5 million last week exploited a zero-day flaw in third-party security products, citing ongoing investigation findings from SlowMist. "Their investigation identified malicious activity involving third-party security products, including a zero-day vulnerability, and recovered a customized tool used by the attacker

Impact

Bitget cryptocurrency exchange, third-party security products

Exploitation Status

This vulnerability is confirmed to be actively exploited by attackers in real-world attacks. Organizations should prioritize patching or implementing workarounds immediately.

Timeline

Disclosed on [date]

Remediation

Not specified

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Zero-day, Vulnerability.

Read Original Article

Related Coverage

WordPress Backdoor Rebuilds Itself After Cleanup Using Files, Database, and Shared Memory

The Hacker News

Researchers have identified a significant security breach involving WordPress sites, where attackers have implemented a backdoor known as SC. This malware is designed to maintain persistent access to infected sites by using various methods for recovery, even after attempts to remove it. The backdoor can reinfect the site through files, database entries, or shared memory, making it particularly challenging for site administrators to eliminate. This incident raises serious concerns for website owners who rely on WordPress, as the backdoor can compromise sensitive information and lead to further attacks. Users and companies need to be vigilant and take proactive measures to secure their sites against such persistent threats.

Oct 1, 2026

Police dismantle KillSec ransomware gang allegedly led by 16-year-old

BleepingComputer

Law enforcement agencies from multiple countries have successfully executed 'Operation KillSwitch', targeting the KillSec ransomware gang. During the operation, authorities seized the gang's data leak site and servers, leading to the arrest of three individuals, including a 16-year-old who is believed to be the group's main administrator. This operation is significant as it disrupts a notable ransomware group that has been involved in various cyberattacks, affecting numerous victims. The dismantling of this gang could help reduce the prevalence of ransomware attacks, which have been a growing concern for businesses and individuals alike. The involvement of a minor in this criminal activity raises questions about the recruitment and involvement of young individuals in cybercrime.

Oct 1, 2026

Kiteworks patches max severity code injection vulnerability

BleepingComputer

Kiteworks, a company specializing in secure file-sharing software, has issued updates to fix 126 vulnerabilities in its products. Among these is a high-severity code injection flaw in their Email Protection Gateway (EPG) security solution, which could allow attackers to execute arbitrary code on affected systems. This vulnerability poses a significant risk as it could lead to unauthorized access and data breaches if exploited. Users of Kiteworks' EPG are particularly urged to apply these patches promptly to safeguard their systems. The rapid response to these vulnerabilities emphasizes the importance of regular software updates in maintaining cybersecurity.

Oct 1, 2026

OpenAI Disrupts Reasoning Extraction Campaign Linked to Moonshot AI Associates

The Hacker News

OpenAI recently revealed that it has disrupted a campaign aimed at extracting sensitive reasoning from its AI models. This operation, linked to a group connected with Moonshot AI, a Beijing-based company, has been ongoing since early July. The campaign involved coordinated efforts to illicitly access proprietary information from OpenAI's systems. This incident raises concerns about the security of AI technologies and the lengths to which some entities may go to exploit them. As AI becomes more integrated into various sectors, safeguarding these systems from unauthorized access is crucial for maintaining trust and innovation in the field.

Oct 1, 2026

Cisco Patches Exploited Catalyst SD-WAN Zero-Day Vulnerability

SecurityWeek

Cisco has released a patch for a serious zero-day vulnerability found in its Catalyst SD-WAN appliances. This flaw could allow remote attackers to gain administrative access to affected devices without needing any authentication. The vulnerability poses a significant risk, as it can be exploited to take control of network infrastructure. Users of Cisco's SD-WAN products should prioritize applying the patch to safeguard their systems. The disclosure of this vulnerability emphasizes the need for organizations to remain vigilant about software updates and security practices.

Oct 1, 2026

Metamask discloses security incident affecting its infrastructure

BleepingComputer

MetaMask, a popular cryptocurrency wallet, has reported an ongoing security incident that affects parts of its infrastructure. While details are still emerging, the company has acknowledged that some users may be impacted by this incident. It's crucial for users to remain vigilant and monitor their accounts for any unusual activity. The exact nature of the security issue has not been fully disclosed, but MetaMask is actively working to address the situation. This incident serves as a reminder of the vulnerabilities that can exist in digital wallet services, highlighting the need for strong security practices among users.

Oct 1, 2026