Cryptocurrency exchange Bitget lost $387.5 million in a breach carried out through a zero-day exploit in third-party security products, according to a report by security firm Rescana.

The figure positions the incident among the largest exchange compromises on record. Unlike direct hacks of exchange hot wallets or compromised private keys, this breach originated outside Bitget's own codebase. Attackers first exploited previously unknown vulnerabilities — zero-days — in security software that Bitget relied on, then used that foothold to reach exchange funds.

What do we know about the attack path?

The Rescana report identifies third-party security products as the initial vector. This detail matters operationally. Exchanges commonly deploy external security tooling — authentication, monitoring, endpoint protection — across their infrastructure. When those tools themselves contain unpatched vulnerabilities, they become a bridge into the very systems they are meant to protect.

A zero-day exploit means the vendor had zero days to patch the flaw before attackers used it. Bitget could not have defended against the bug through normal patching cycles. The attack instead exposed a structural risk: security dependencies that sit in the trusted path of an exchange's operations.

The $387.5 million loss indicates the attackers moved from the initial foothold to fund custody or treasury systems without being stopped by internal controls.

What are the business consequences for Bitget?

A breach of this scale carries consequences beyond the immediate loss:

• Solvency and proof-of-reserves pressure. A $387.5 million shortfall will force Bitget to demonstrate it can absorb the loss, whether through reserves, insurance coverage or capital injection.
• Vendor liability questions. Because the exploit lived in third-party security products, responsibility may be contested among Bitget, the unnamed security vendors, and their insurers.
• Customer withdrawal risk. Historical precedent shows exchanges breached at this scale face runs on deposits unless they quickly prove liquidity.
• Regulatory scrutiny. Jurisdictions where Bitget operates will examine whether its vendor-risk management and custody arrangements met applicable standards.

The report does not name the specific security vendors whose products contained the zero-days, a gap that leaves the wider exchange sector unable to assess its own exposure to the same flaws.

Why does the third-party vector matter for the industry?

Crypto exchanges have hardened their own infrastructure significantly since the exchange hacks of the last decade. Multisignature custody, hardware security modules and withdrawal delays now block many conventional attacks. Attackers have responded by moving up the supply chain — targeting the software vendors, contractors and security tools that surround exchanges rather than the exchanges' own code.

A breach that enters through a security product inverts the assumed trust model. The tools deployed to detect intrusions become the intrusion vector. For risk teams across the industry, the Bitget incident is a case study in dependency risk: every third-party component in the transaction path must be treated as an attack surface in its own right.

The incident will likely accelerate two industry practices: contractual security requirements and disclosure obligations for vendors serving crypto firms, and broader adoption of vendor-independent monitoring that does not rely on a single security stack.

What happens next?

Expect Bitget to detail the scope of affected accounts, the identity of the exploited products, and any recovery or reimbursement plan in the coming days. Whether the affected security vendors issue patches — and whether other exchanges running the same products rush to update — will determine whether this incident stays isolated to Bitget or marks the first confirmed casualty of a wider supply-chain campaign.