The exchange published details of the breach, confirming the incident resulted from a previously unknown flaw in external security tooling rather than a direct compromise of its own core infrastructure. The zero-day was leveraged as the initial access vector, allowing the attackers to breach Bitget's environment.

Key points:

• The attacker exploited a zero-day flaw in third-party security products to breach Bitget's systems.
• The total amount stolen in the incident was $387.5 million.
• The breach occurred last week, with Bitget disclosing the root cause today.
• No specific CVE identifier has been provided for the flaw at this time.

This case highlights the supply chain risk that third-party security software can introduce, even for organizations with otherwise robust internal defenses. When a security product itself becomes the entry point, traditional perimeter controls may offer limited protection.

Source: Unknown

Does your organization review the security posture of its third-party security vendors, and how are you mitigating supply chain risk in your stack?