Malicious Firefox extensions impersonate popular crypto wallets

Socket’s threat researchers found three malicious Firefox extensions that impersonated the Phantom, Jupiter, and Bitget crypto wallets. Once installed, the malicious extensions stole recovery phrases and private keys, which would provide the attacker with full control of a wallet. A crypto wallet...

Bitget Confirms Third-Party Zero-Day Behind $387.5 Million Cryptocurrency Theft

Cryptocurrency exchange Bitget on Wednesday confirmed that attackers who stole $387.5 million last week exploited a zero-day flaw in third-party security products, citing ongoing investigation findings from SlowMist. "Their investigation identified malicious activity involving third-party securit...

Bitget Says Attacker Exploited Third-Party Security Product Flaw to Steal $388M

The attacker who stole about $388 million from the cryptocurrency exchange Bitget gained access through a vulnerability in a third-party security product the exchange used, Bitget said on Monday. The attacker exploited the flaw to obtain high-level internal credentials and then, on September 24,...

Bitget Says Suspected North Korean Hackers Stole $351.6M After Backend Compromise

Cryptocurrency exchange Bitget said suspected North Korean threat actors have stolen $351.6 million from its hot and warm wallets. "At 18:31 UTC on September 24, 2026, Bitget's security systems identified unauthorized transfers involving a limited number of hot wallets," Bitget said in a post...

Bitget Confirms $351.6 Million Hack, Suspects North Korea’s Lazarus Group

Bitget confirms a $351.6 million theft, suspends withdrawals and says North Korea's Lazarus Group may be involved as investigators examine the breach in detail...

Malicious code in python-bitget-request (PyPI)

Source: kam193 bf787bcce66ad47046d93086a114a0f144b0f538b3d969fea6aea42b2312f58b Importing the module starts an obfuscated PowerShell code, which downloads and executes a remote script. On Windows, the script appears to just start the calculator. On MacOS, the file is identified as a Spark RAT by...

Malicious code in python-bitget-connect (PyPI)

Source: kam193 1797b7fdf9859888b5495817784ead0bdc01e6acad5ae410af1e1df89acbded6 Importing the module starts an obfuscated PowerShell code, which downloads and executes a remote script. On Windows, the script appears to just start the calculator. On MacOS, the file is identified as a Spark RAT by...

Malicious code in python-bitget-wrapper (PyPI)

Source: kam193 769187e87797e69e9ebfc00eb97274a91fea1c86b1472b4ef6436441f737c8b9 Importing the module starts an obfuscated PowerShell code, which downloads and executes a remote script. On Windows, the script appears to just start the calculator. On MacOS, the file is identified as a Spark RAT by...

Malicious code in python-bitget-api (PyPI)

Source: kam193 cac6988c3746b27c0cc34a156657431c2a0c0c36de45c6b88a00130d30dfd66e Importing the module starts an obfuscated PowerShell code, which downloads and executes a remote script. On Windows, the script appears to just start the calculator. On MacOS, the file is identified as a Spark RAT by...

MAL-2025-2093 Malicious code in bitget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bee4a7fd704a8fea75c22457e3aaa5dedb79b3a440c2aed58f507e32e340e358 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in bitget-main (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 06e640734ec5e28eb4cd980ba22401e01aafb30604056e6ce588cd9df053229b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malware in bitget-main

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in bitget-dev

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in bitget-internal

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2025-2095 Malicious code in bitget-internal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cb95beffc6efb8662038329634e713d9210de5390298fe4811ebec827a9e2848 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in bitget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bee4a7fd704a8fea75c22457e3aaa5dedb79b3a440c2aed58f507e32e340e358 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in bitget-dev (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c98dc8a8cb993a1e93d89d0909e8243bfd607c7a635f098ee3b3c103101cbcbe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2094 Malicious code in bitget-dev (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c98dc8a8cb993a1e93d89d0909e8243bfd607c7a635f098ee3b3c103101cbcbe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2096 Malicious code in bitget-main (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 06e640734ec5e28eb4cd980ba22401e01aafb30604056e6ce588cd9df053229b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in bitget-internal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cb95beffc6efb8662038329634e713d9210de5390298fe4811ebec827a9e2848 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...