You can build the tightest vault in the world, but if you hand a spare key to a vendor who leaves it under the doormat, none of that matters. That's the expensive lesson crypto exchange Bitget just learned, to the tune of $388 million.

The Heist That Started Somewhere Else Entirely

On September 24, Bitget detected unauthorized transfers draining its hot wallets and scrambled to suspend withdrawals. The exchange first pegged the damage at around $352 million before revising it upward to roughly $388 million once the full scope came into focus. Bitget's cold wallets and private keys were never touched, and the company says customer account balances remain intact.

The actual breach didn't come from a flaw in Bitget's own code — it came through a vulnerability in a third-party security product the exchange relied on. The attacker used that flaw to obtain high-level internal credentials, then used those credentials to send fraudulent withdrawal commands straight to Bitget's wallet system. Mandiant and SlowMist are now doing the forensic autopsy, and Bitget has restricted internal access, added independent verification for withdrawals, and cranked up monitoring.

Your Vendor's Bug Is Your Breach

This is the part that should make every business squirm a little: Bitget didn't get hacked because it was careless. It got hacked because it trusted a security product to do the one job security products exist to do, and that product had a hole in it. The organization did everything "right" by conventional standards and still ended up down $388 million.

Supply-chain and third-party risk keeps winning because it's the path of least resistance for attackers — why break down the front door when a vendor's back door is unlocked and nobody's watching it as closely? Every integration, plugin, and "trusted" security tool is a door you didn't build and can't fully audit, which is exactly why vetting them matters as much as vetting your own code.

$388 million is a very expensive way to learn that "trusted third party" and "trustworthy third party" are not the same sentence.

If you're not sure which of your own integrations and plugins could be someone else's next headline, that's the exact gap our free supply-chain security checklist is built to close — download it here.

Source: The Hacker News