Bitget hit by zero-day exploit, $387.5M stolen from third-party security products

Key points

• Bitget suffered a system breach via a zero-day in third-party security products.
• Attackers stole $387.5 million in funds.
• Incident occurred last week; no CVE assigned yet.
• Third-party security vendors are implicated, highlighting supply-chain risk.
• Education sector should review vendor dependencies and zero-day response.

A week ago, malicious actors leveraged an undisclosed zero-day flaw in external security offerings to breach Bitget's infrastructure. The breach resulted in the theft of $387.5 million in funds. Bitget, a cryptocurrency exchange, confirmed the incident, and third-party security vendors are now under scrutiny. No CVE identifier has been assigned yet, leaving defenders without a standard reference for tracking.

The affected parties include Bitget, its users who lost assets, and the third-party security vendors whose products were leveraged as an entry point. For the K-12 education sector, this event underscores the cascading risk of relying on external security tools. A single flaw in a vendor's product can open doors to sensitive systems, even if your own defenses are robust.

Why does this matter? Supply-chain attacks are rising, and zero-days are particularly dangerous because they bypass signature-based defenses. The financial scale—nearly $388 million—demonstrates the high stakes. While Bitget is a crypto platform, the tactics apply broadly: attackers seek weak links in trusted software. Schools and government agencies often use third-party security products for endpoint protection, firewalls, and monitoring, making them potential targets.

Context: The incident occurred amid increased scrutiny of crypto exchanges and their security practices. Third-party vendors may face liability and reputational damage. For education IT teams, the lesson is clear: you cannot outsource all risk. You must maintain visibility into vendor dependencies and have contingency plans.

What to watch: Attribution of the attack, whether the zero-day is patched, and any regulatory actions. Also monitor for similar exploits targeting security products used in education. Stay informed through vendor advisories and threat intelligence feeds.

What to do now

1. Inventory all third-party security products in use and identify vendor dependencies.
2. Immediately apply any available patches or mitigations from vendors; if none, consider temporary workarounds or disabling affected features.
3. Segment networks to limit lateral movement if a security product is compromised.
4. Review contracts and SLAs with third-party vendors for breach notification and liability clauses.
5. Enhance monitoring for anomalous activity, especially around security tools and privileged accounts.
6. Conduct a tabletop exercise for supply-chain breach scenarios.
7. Report suspicious activity to relevant authorities and share threat intelligence with peers.

Original source

BleepingComputer