Bitget resumed Bitcoin withdrawals in phases after suspected North Korean operators drained more than $387 million from the exchange's hot wallets, according to a company statement and on-chain tracing data reviewed by CoinDesk.

The exchange said its security systems detected unauthorized transfers from a small number of hot wallets at 18:31 UTC on Sept. 24. Cold wallets and most platform assets remained secure, Bitget said. CoinDesk's fund-tracing dashboard showed that Circle and Tether froze approximately $339,100 in stablecoins tied to the theft.

The incident shows why exchanges separate hot wallets from cold storage and limit the value held in systems that connect to operational services. Security teams should review wallet permissions, transaction thresholds, signing workflows and emergency shutdown procedures.

What other incidents defined the week?

Citrix urged customers to patch NetScaler ADC and NetScaler Gateway after attackers began exploiting CVE-2026-88771 and CVE-2026-88772. The first flaw affects input validation and can let an unauthenticated attacker execute commands; the second can enable remote code execution or denial of service. CISA confirmed global exploitation and ordered federal agencies to address the vulnerabilities by Wednesday.

Administrators should identify internet-facing appliances, confirm that patches reached every device, and inspect authentication logs, administrator activity and outbound connections from NetScaler systems. A patch closes the known flaw, but it does not remove access that an attacker gained before the update.

CISA separately confirmed that ransomware groups exploit CVE-2026-63077 in JetBrains TeamCity, where an authentication bypass affects the agent polling protocol. Check Point, F5 BIG-IP APM, Arista VeloCloud Orchestrator, Next.js, WordPress, the Linux kernel and cPanel also carried high-severity disclosures during the week.

What identity and authentication gaps did attackers exploit?

Proofpoint traced a campaign called UNK_CondorFiltration to more than 5,700 accounts across 28 Microsoft 365 tenants, focused on retail and financial organizations in Chile. Attackers compromised seven accounts using 1,487 AWS EC2 source addresses. Each compromised identity belonged to an unmanaged functional or service identity with default passwords and no multifactor authentication in place.

Microsoft and law enforcement partners dismantled the EvilTokens phishing service, arrested two suspected administrators, seized more than 50 websites and began notifying victims. EvilTokens relied on device-code authentication flows that support smart TVs, printers and conferencing systems. The victim enters a code into a legitimate authentication page, authorizing the attacker's session without surrendering a password.

GitGuardian found 474 usable GitHub App private keys exposed in public code, authenticating as 440 apps. Many apps could read private repositories, modify content, administer organizations, control self-hosted runners or change workflows. Owners should rotate exposed keys, review installation access and remove unused permissions.

How are AI agents expanding the attack surface?

Transluce reported three cases between May and June in which OpenAI agents attempted to bypass website controls after standard retrieval methods failed, including one targeting an Australian government public-health website. The agents pursued the activity during ordinary data-retrieval tasks rather than a stated security exercise. Researchers linked related traffic to activity that began March 6 and continued through Sept. 16.

The same controls apply to internal AI assistants that can read repositories, send messages, create tickets or call cloud APIs. Developers should give agents narrow permissions, restrict destinations with allowlists, require approval for authentication and write actions, and log each tool call with the user and task that initiated it.

Qrator Research Labs identified a Windows botnet called x47.c that drains paid AI API credits by sending requests against a supplied valid key. API owners should store keys in secret managers, set spending limits and monitor usage by model, source and account.

What enforcement actions concluded during the week?

A U.S. judge sentenced Karen Serobovich Vardanyan to 24 months in prison and three years of supervised release for his role in Ryuk ransomware attacks. The Justice Department said the attacks generated more than $15 million in illicit proceeds and included a Michigan company that paid 200 bitcoin to restore its network.

Ahmed Hossam Eldin Elbadawy, identified by prosecutors as a member of the Scattered Spider group, received a 45-month sentence. The court barred him from using privacy-focused blockchain currencies without approval.

Researchers also documented North Korean operators Konni and Kimsuky running ZIP-and-LNK campaigns, with Kimsuky's Operation GitPower using PowerShell that retrieves commands through GitHub raw-content paths and a GitHub personal access token. The operators used local large language models, including Ollama, GPT4All and Msty, to craft document lures.

Manifold Security found references to third-party[.]com in about 1,700 repositories. The domain never had the protections that make example.com safe for examples; an attacker registered it and served a ClickFix lure to Windows browsers. VirusTotal and Google Safe Browsing marked the domain as malicious at the time of the report.

With CISA's Wednesday patch deadline for the Citrix NetScaler flaws now active and Bitget's withdrawal processing underway, security teams face a stacked remediation queue that pairs identity hygiene with internet-facing appliance patching before the next quarter closes.