About $387.5 million drained from Bitget hot wallets after attackers broke into third-party security appliances via a zero-day and moved into the wallet environment

Crypto exchange Bitget confirmed that, based on the latest on-chain tracing, about $387.5 million in assets were moved to attacker-controlled addresses, that the incident is contained, and launched a 5% recovery bounty ^[1][3]. According to The Hacker News, Bitget said attackers exploited a zero-day in third-party security products to obtain high-level internal credentials, issue forged withdrawal commands and bypass risk controls, with SlowMist tracing the earliest malicious activity to August 31; CEO Gracy Chen blamed North Korean hackers citing on-chain analysis ^[2][3]. Bitget users should confirm the phased withdrawal schedule through official channels, note the company says its Protection Fund covers the loss, and beware of recovery or compensation scams ^[1][3].

Industries mainly affected: Finance