# Bitget's $387.5 Million Theft Leads a Run of Hot-Wallet and Infrastructure Breaches That Bypassed Contract Audits

Investigators trace the Bitget theft to zero-day flaws in two third-party security appliances and to North Korea-linked actors, while NEAR Intents, Duelbits, Nostra and SingularityNET lost funds through custody integrations, private keys, oracles and cloud access.

- Published: 2026-10-09T05:49:33.680Z
- Canonical: https://polylog.news/crypto/2026-10-09/bitget-s-387-5-million-theft-leads-a-run-of-hot-wallet-and-i
- Publisher: Polylog (Crypto desk)
- Section: crypto
- Sources: [Rekt News (Bitget)](https://www.rekt.news/), [The Hacker News](https://thehackernews.com/2026/10/bitget-confirms-third-party-zero-day.html), [CryptoTicker](https://cryptoticker.io/en/bitget-hack-north-korea-attribution/), [CoinDesk](https://www.coindesk.com/tech/2026/10/01/near-intents-hit-by-usd3-8-million-exploit-as-crypto-s-rough-year-of-hacks-continues), [Crypto Briefing](https://cryptobriefing.com/near-intents-omni-bug-exploit-funds-returned/), [ForkLog](https://forklog.com/en/crypto-casino-duelbits-resumes-operations-after-7m-hack/), [BeInCrypto](https://beincrypto.com/crypto-hack-losses-september-2026-bitget/)

[Rekt News](https://www.rekt.news/) has published post-mortems on a cluster of recent incidents. In most of them the failure point was infrastructure around the contracts, not contract code. The largest is Bitget. The exchange disclosed on September 24 that attackers took $387.5 million from its hot and warm wallets across 11 chains, including Ethereum, Tron, the XRP Ledger and Zcash. Separate investigations by SlowMist and Mandiant, the cyber-defense arm of Google Cloud, found that the attackers [compromised two third-party security appliances with zero-day exploits](https://thehackernews.com/2026/10/bitget-confirms-third-party-zero-day.html). They used that access to obtain high-level internal credentials and to issue withdrawal commands that bypassed Bitget's risk controls. SlowMist dated the earliest malicious activity to August 31, more than three weeks before the theft. Circle, Tether and NEAR Intents froze about $1.1 million. Chainalysis [attributed the theft](https://cryptoticker.io/en/bitget-hack-north-korea-attribution/) to actors tied to North Korea, and Bitget cites IP behavior and on-chain analysis that point the same way. Pyongyang does not comment on such attributions.

On October 1, NEAR Intents [lost $3.8 million](https://www.coindesk.com/tech/2026/10/01/near-intents-hit-by-usd3-8-million-exploit-as-crypto-s-rough-year-of-hacks-continues) and restricted deposits and withdrawals on 11 networks. The root cause was a bug in the interaction between the NEAR Intents contract and the custody architecture of Omni, its bridge, which allowed unauthorized withdrawals of USDT from a hot wallet on BNB Chain. Alex Shevchenko, NEAR Intents' general manager, publicly named the attacker and set a 48-hour deadline. The full $3.865 million [came back within 24 hours](https://cryptobriefing.com/near-intents-omni-bug-exploit-funds-returned/).

The crypto casino Duelbits lost about $7 million when an attacker moved funds from its hot wallets on five chains in a suspected private-key compromise. The casino [has since resumed operations](https://forklog.com/en/crypto-casino-duelbits-resumes-operations-after-7m-hack/). Nostra, a lending protocol on Starknet, lost $3.5 million to an oracle exploit. At SingularityNET, an attacker reached the project's cloud infrastructure and used it to mint tokens on its bridge without authorization and drain funds. [BeInCrypto counts](https://beincrypto.com/crypto-hack-losses-september-2026-bitget/) a 462% month-on-month jump in hack losses in September, driven by Bitget.

## What this means

Every incident here except Nostra's oracle failure came through operational infrastructure: appliances, cloud accounts, hot-wallet keys and custody integrations that no smart-contract audit covers. That puts centralized exchanges and any protocol that runs a hot wallet or a bridge relayer at risk, along with the insurers and market makers who price counterparty exposure to them. The Bybit theft of February 2025, also attributed to North Korea and also executed through infrastructure around the signing flow, was followed by industry-wide reviews of signing tooling and did not slow the attacks. The likelier outcome over the next few months is that exchanges move more balances into cold storage and tighten vendor access. Withdrawal times rise, and North Korea-linked groups shift to softer targets such as casinos, payment processors and bridges. A major theft traced to a flaw in audited contract code, not operational access, would undercut this read.

## What to watch

- Whether Mandiant or the appliance vendor names the compromised security product. Other exchanges running the same product would then face disclosure pressure.
- How much of the Bitget haul passes through cross-chain swap services and mixers. Freezes by Circle and Tether so far cover only a small fraction.
- Whether NEAR Intents publishes a full post-mortem on the Omni custody integration. Similar intent-based bridges rely on comparable hot-wallet designs.