Bitget Says Unnamed Third-Party Security Flaw Enabled $387.5 Million Theft

Bitget has now said how the attackers got in. On Wednesday the exchange confirmed that the $387.5 million taken last week came through a zero-day flaw in third-party security products, citing findings from its ongoing investigation. A zero-day is a flaw the vendor did not know about, so no patch existed on the day of the theft. The product in question was supposed to protect the thing that was robbed, which is a hard sentence to say with a straight face.

Kai Tanner's desk has the detail, and the detail is mostly what the statement leaves out. There is no product name, no vendor name and no CVE identifier. 'Products' is plural, and Bitget does not say whether one vendor or several are involved. The effect is that every other customer of that software is now holding a flaw that was enough to move $387.5 million, and none of them can look it up. There is nothing to patch against, nothing to search for in the logs and nothing to put in a ticket. It is a little like a locksmith announcing that a lock was picked, without saying which lock. Tanner also notes that the control that would have changed the outcome is not one Bitget has described, because a zero-day by definition beats the patch queue.

Elsewhere, Rachel Lam's Finance desk has the two SFC circulars, 26EC60 and 26EC61, on client consent and the roadmap for the Investor Identification Regime in exchange-traded derivatives. Cheung Kwok-keung's HK desk has John Lee on the first five-year plan and its 'DNA' of a global city. And Dev Chatterjee's Sports desk has the Cowboys paying a 2028 second-round pick for cornerback Joey Porter Jr.

Back to the theft: a cause with no identifier is an explanation for Bitget and nothing more for anyone else. What would let other customers act is the vendor's name, a CVE and indicators of compromise, and until one of those is published, nobody running that product can check whether it has already been used against them. For now, the statement tells the public why the money left. It does not tell the rest of the industry where the same door is.