Bitget attacker tested risk controls before $388M theft, CEO says

💥 BREACHES & INCIDENTS

• Bitget attacker tested risk controls with small transfers before $388 million theft, CEO says
  Bitget's CEO says the attacker behind the $388 million theft exploited a zero-day in a third-party security product to inject fraudulent withdrawal commands.
  • Applies to Bitget exchange users; the $388 million loss will be absorbed by the user protection fund, to be replenished to at least $300 million within a week
  • The attacker exploited a zero-day in a third-party security product to obtain valid admin credentials for an internal management system
  • Fraudulent withdrawal commands were injected into wallet backend systems and treated as legitimate; traces were deleted afterward
  • Two small test transfers at 6:31 p.m. UTC on Sept. 24 (0.184 ETH, 193 TRX) evaded risk controls before 17 transactions totaling ~$361 million across Ethereum, XRP, Zcash, BNB Chain, Base, Arbitrum, Optimism, and Avalanche
  • Private keys and cold wallets were not compromised; Bitget is investigating with Mandiant and SlowMist, with a formal incident report expected this week
  Sources 📎 Coverage: theblock.co · 👁 via @campuscodi@mastodon.social

🔓 CVEs & KEV

• CVE-2026-102361 — gz-yami mall4j — CVSS 9.3 — mall4j through 4.0 Missing Authentication in Password Update Endpointmall4j t...

• CVE-2026-102373 — GestSup — CVSS 7.1 — GestSup before 3.2.62 Private Ticket Comment Disclosure via threadedit Parame...

• CVE-2026-102365 — gz-yami mall4j — CVSS 7.1 — mall4j through 4.0 Missing Authorization in Admin User Address Endpointsmall4...

• CVE-2026-102362 — gz-yami mall4j — CVSS 6.9 — mall4j through 4.0 Missing Authentication in Product Review Deletionmall4j th...

• CVE-2026-18747 — zephyrproject zephyr — CVSS 6.8 — Integer underflow of net_buf length in the MCUmgr serial (SMP over console) t...

• CVE-2026-18417 — zephyrproject zephyr — CVSS 6.5 — Wild pointer dereference in Zephyr BSD sockets when a TCP listening socket re...

• CVE-2026-102363 — gz-yami mall4j — CVSS 6.3 — mall4j through 4.0 Unauthenticated Shipment Tracking Disclosure via Order Num...

📋 ADVISORIES

• 📄 Source for Ziroom ZHOME A0101 1.0.1.0 set_passwd endpoint vulnerable to command injection (CVE-2026-101264) — vuldb.com