Bitget says its first security crisis stemmed from a supply-chain attack on third-party security software; independent review initiated
BIBIBI
AT A GLANCE
Bitget says the attacker exploited a vulnerability in a third-party product to obtain internal network credentials; private keys and cold-wallet assets were unaffected, and an independent review has been initiated.
Article
Xie Jiayin responds to Bitget 8 first security incident: hackers launched an attack by exploiting a vulnerability in a third-party security product; an independent review has been initiated jointly
PANews September 28 reported that, according to official news, Xie Jiayin, head of Bitget Greater China, directly addressed community concerns during a recent livestream. He recalled that Bitget was established 8 years ago and has always placed the security of user assets at the highest priority, successfully fending off multiple cyberattack attempts and maintaining a long-term record of secure operations. This incident was the platform’s first security crisis in its 8-year history. Following a complete trace-back, the incident was identified as a specialized attack targeting the supply chain of third-party security software. The attacker exploited a vulnerability in a third-party product to obtain internal network credentials, but private keys were not leaked and cold-wallet assets were unaffected. Bitget has now jointly launched an independent review with security firms Mandiant and SlowMist and will comprehensively upgrade its monitoring and management standards for third-party components. We are committed not only to achieving a comprehensive recovery following the incident, but also to using...
(Read the full article via the link below)
🔗https://www.panewslab.com/zh/articles/01a0e721-ef79-7652-a133-20ca92ae5e9a
Key points
01
PANews said the information came from official news.
02
Xie Jiayin, head of Bitget Greater China, responded to community concerns during a recent livestream.
03
Xie Jiayin said this incident was Bitget’s first security crisis since its establishment 8 years ago.
04
Xie Jiayin said the attacker exploited a vulnerability in a third-party product to obtain internal network credentials.
05
Xie Jiayin said that private keys were not leaked and cold-wallet assets were unaffected.
06
Bitget has jointly launched an independent review with Mandiant and SlowMist.
07
Bitget said it will comprehensively upgrade its monitoring and management standards for third-party components.
AI-assisted interpretation
The following is analysis, separate from reported facts. Verify important claims independently.
According to the original wording, the issue occurred in the supply chain of a third-party security product: attackers exploited a vulnerability in the third-party product to obtain access credentials for Bitget’s internal network. Bitget also stated that critical private keys were not leaked and that assets in cold wallets were not affected. Mandiant and SlowMist are currently participating in an independent review.
Why it matters to readers
The acquisition of internal network credentials indicates that the platform’s internal systems may face a risk of unauthorized access. Even though Bitget says that private keys and cold-wallet assets were unaffected, the ultimate scope of the impact remains subject to further confirmation through the independent review.
If you use Bitget, you should pay attention to the independent review results and the scope of the impact and remediation measures subsequently announced by the platform. The original text does not provide information on any specific actions users need to take.
Risks and unknowns
The conclusions that private keys were not leaked and that cold-wallet assets were not affected come from Bitget’s statements; the original text does not provide the results of an independent review.
The original text does not specify which internal systems were affected or the specific scope of access obtained through the internal-network credentials.
The original text does not clearly state whether any user assets were lost.
Related Developments
Loading event timeline…
The original text does not provide specific progress updates on vulnerability remediation, credential replacement, or service restoration.
The body text is truncated with an ellipsis and prompts readers to click a link to read the full article; the available evidence is not a complete report.
Related concepts
Supply-chain attack
This term is not in the glossary yet. Browse related concepts in the glossary.
