What happened
On September 24, 2026, cryptocurrency exchange Bitget experienced a critical security breach. Unauthorized transfers were detected at 18:31 UTC involving a limited number of hot wallets. These transfers resulted in the theft of approximately $351.6 million. The incident was identified through Bitget’s security systems, which flagged the activity as suspicious. The breach appears to have been facilitated by a compromise of the platform’s backend systems, leading to significant financial loss.
According to reports, the affected component was a Microsoft Exchange server. The attack is believed to have exploited vulnerabilities in this component to gain unauthorised access. The exchange confirmed that their cold wallets and the overwhelming majority of platform assets remained secure, indicating that the attack was targeted or limited in scope. The severity of this event underscores the potential for high-impact exploits stemming from compromised enterprise messaging infrastructure.
Who is affected
Organisations running Microsoft Exchange that manage or rely on similar backend infrastructure may be at risk if they have not applied recent security updates or mitigations. Cryptocurrency exchanges, financial institutions, and any entities using exposed Exchange servers could be vulnerable to similar threat activity. Since the attack involved a backend compromise, any deployment with unpatched or misconfigured Microsoft Exchange systems could be at risk of unauthorised access, which might facilitate data theft or further malicious actions.
Recommended actions
- Assess the security status of Microsoft Exchange servers, verifying that all security patches and updates are applied to mitigate known vulnerabilities.
- Review access controls and audit logs for any signs of unauthorised activity, especially relating to the affected component.
- Implement network segmentation and restrict access to critical backend components to reduce the attack surface.
- Monitor for unusual activity on email servers and network traffic indicative of lateral movement or data exfiltration.
- Ensure incident response procedures are prepared to contain and investigate any suspected compromise involving messaging infrastructure.
Indicators of compromise
Specific indicators have not been provided at this time; organisations are advised to monitor security advisories for updates and to review logs for signs of unauthorised access involving Microsoft Exchange or related systems.
