Bitget Confirms Third-Party Zero-Day Behind $387.5 Million Cryptocurrency Theft

Cryptocurrency exchange Bitget on Wednesday confirmed that attackers who stole $387.5 million last week exploited a zero-day flaw in third-party security products, citing ongoing investigation findings from SlowMist. "Their investigation identified malicious activity involving third-party securit...

Bitget Says Suspected North Korean Hackers Stole $351.6M After Backend Compromise

Cryptocurrency exchange Bitget said suspected North Korean threat actors have stolen $351.6 million from its hot and warm wallets. "At 18:31 UTC on September 24, 2026, Bitget's security systems identified unauthorized transfers involving a limited number of hot wallets," Bitget said in a post...

Malicious code in bitget-main (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 06e640734ec5e28eb4cd980ba22401e01aafb30604056e6ce588cd9df053229b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2093 Malicious code in bitget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bee4a7fd704a8fea75c22457e3aaa5dedb79b3a440c2aed58f507e32e340e358 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in bitget-dev (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c98dc8a8cb993a1e93d89d0909e8243bfd607c7a635f098ee3b3c103101cbcbe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in bitget (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bee4a7fd704a8fea75c22457e3aaa5dedb79b3a440c2aed58f507e32e340e358 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2095 Malicious code in bitget-internal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cb95beffc6efb8662038329634e713d9210de5390298fe4811ebec827a9e2848 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in bitget-internal (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cb95beffc6efb8662038329634e713d9210de5390298fe4811ebec827a9e2848 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2096 Malicious code in bitget-main (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 06e640734ec5e28eb4cd980ba22401e01aafb30604056e6ce588cd9df053229b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2094 Malicious code in bitget-dev (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c98dc8a8cb993a1e93d89d0909e8243bfd607c7a635f098ee3b3c103101cbcbe Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in python-bitget-wrapper (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 769187e87797e69e9ebfc00eb97274a91fea1c86b1472b4ef6436441f737c8b9 Importing the module starts an obfuscated PowerShell code, which downloads and executes a remote script. On Windows, the script appears to just start the...

Malicious code in python-bitget-request (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 bf787bcce66ad47046d93086a114a0f144b0f538b3d969fea6aea42b2312f58b Importing the module starts an obfuscated PowerShell code, which downloads and executes a remote script. On Windows, the script appears to just start the...

MAL-2025-961 Malicious code in python-bitget-connect (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1797b7fdf9859888b5495817784ead0bdc01e6acad5ae410af1e1df89acbded6 Importing the module starts an obfuscated PowerShell code, which downloads and executes a remote script. On Windows, the script appears to just start the...

Malicious code in python-bitget-connect (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 1797b7fdf9859888b5495817784ead0bdc01e6acad5ae410af1e1df89acbded6 Importing the module starts an obfuscated PowerShell code, which downloads and executes a remote script. On Windows, the script appears to just start the...

MAL-2025-962 Malicious code in python-bitget-request (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 bf787bcce66ad47046d93086a114a0f144b0f538b3d969fea6aea42b2312f58b Importing the module starts an obfuscated PowerShell code, which downloads and executes a remote script. On Windows, the script appears to just start the...

MAL-2025-963 Malicious code in python-bitget-wrapper (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 769187e87797e69e9ebfc00eb97274a91fea1c86b1472b4ef6436441f737c8b9 Importing the module starts an obfuscated PowerShell code, which downloads and executes a remote script. On Windows, the script appears to just start the...