Bitget $351.6M Hot Wallet Theft: Defending Crypto Exchange Infrastructure Against Suspected DPRK Backend Compromise

---
title: Credential Dumping Tool Execution on Backend or Signing Infrastructure
id: 8f2c1a47-3b9e-4d51-a6c2-7e8f4b1d9a30
status: experimental
description: Detects execution of common credential access tooling on servers hosting wallet signing, withdrawal processing, or exchange backend services. DPRK actors routinely harvest SSH keys, tokens, and service credentials before reaching signing infrastructure.
references:
  - https://attack.mitre.org/techniques/T1003/
  - https://thehackernews.com/2026/09/bitget-says-suspected-north-korean.html
author: Security Arsenal
date: 2026/09/25
tags:
  - attack.credential_access
  - attack.t1003
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\mimikatz.exe'
      - '\procdump.exe'
      - '\nanodump.exe'
      - '\pypykatz.exe'
      - '\rundll32.exe'
  selection_cli:
    CommandLine|contains:
      - 'sekurlsa::'
      - 'lsadump::'
      - 'comsvcs.dll'
      - 'MiniDump'
      - 'lsass'
  condition: selection_img and selection_cli
falsepositives:
  - Legitimate LSASS dumps by approved EDR/forensics tooling
  - Admin memory diagnostics
level: high
---
title: Suspicious Shell or Script Execution on Linux Wallet Signing Hosts
id: 4d7e9b21-6a3f-4c88-b2d5-9f1a3c6e8b42
status: experimental
description: Detects interactive shells, base64-decoded payloads, and living-off-the-land downloaders spawned by wallet daemon, node, or signing service processes on Linux infrastructure. Backend services should rarely spawn shells; this is a strong intrusion indicator on transaction-signing hosts.
references:
  - https://attack.mitre.org/techniques/T1059/004/
  - https://thehackernews.com/2026/09/bitget-says-suspected-north-korean.html
author: Security Arsenal
date: 2026/09/25
tags:
  - attack.execution
  - attack.t1059.004
  - attack.t1105
logsource:
  category: process_creation
  product: linux
detection:
  selection_parent:
    ParentImage|endswith:
      - '/bitcoind'
      - '/geth'
      - '/node'
      - '/java'
      - '/python'
      - '/python3'
      - '/dockerd'
      - '/containerd'
  selection_child:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/curl'
      - '/wget'
      - '/nc'
      - '/ncat'
      - '/socat'
      - '/base64'
      - '/python'
      - '/python3'
  condition: selection_parent and selection_child
falsepositives:
  - Wallet node health-check scripts invoking curl
  - Container orchestration agents
level: high
---
title: Outbound Connection from Signing or Wallet Host to Unapproved Destination
id: 2b6a8d13-9c4e-4f71-a3b8-5d2e7f9c1a64
status: experimental
description: Detects network connections from wallet/signing backend processes to rare external destinations. Signing hosts should communicate only with a strict allowlist (chain RPC endpoints, internal services); new outbound destinations can indicate C2 or exfiltration during a wallet-draining intrusion.
references:
  - https://attack.mitre.org/techniques/T1071/
  - https://thehackernews.com/2026/09/bitget-says-suspected-north-korean.html
author: Security Arsenal
date: 2026/09/25
tags:
  - attack.command_and_control
  - attack.t1071
  - attack.exfiltration
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    Image|endswith:
      - '/bitcoind'
      - '/geth'
      - '/node'
      - '/java'
  filter_allowlist:
    DestinationIp|cidr:
      - '10.0.0.0/8'
      - '172.16.0.0/12'
      - '192.168.0.0/16'
  condition: selection and not filter_allowlist
falsepositives:
  - Blockchain peer-to-peer gossip traffic on daemon ports (restrict rule to signing/API processes rather than P2P daemons if noisy)
  - Package updates from repo mirrors
level: medium

// Hunt 1: Backend/wallet service processes spawning shells or downloaders (Linux via Syslog + MDE)
let WalletParents = dynamic(["bitcoind","geth","node","java","dockerd","containerd"]);
let SuspiciousChildren = dynamic(["bash","sh","curl","wget","nc","ncat","socat","base64"]);
union isfuzzy=true
    (Syslog
    | where Facility == "user" or SyslogMessage has "execve"
    | extend Parent = extract(@"PPID comm=(\w+)", 1, SyslogMessage),
             Child  = extract(@"comm=(\w+)", 1, SyslogMessage)
    | where Parent in~ (WalletParents) and Child in~ (SuspiciousChildren)
    | project TimeGenerated, Computer, Parent, Child, SyslogMessage),
    (DeviceProcessEvents
    | where InitiatingProcessFileName in~ (WalletParents)
    | where FileName in~ (SuspiciousChildren)
        or ProcessCommandLine has_any ("base64 -d", "curl http", "wget http", "| sh", "| bash")
    | project TimeGenerated, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName)
| order by TimeGenerated desc;

// Hunt 2: Rare outbound destinations from signing/backend hosts (last 24h vs 14d baseline)
let Baseline =
    DeviceNetworkEvents
    | where TimeGenerated > ago(14d) and TimeGenerated < ago(1d)
    | where InitiatingProcessFileName in~ ("node","java","bitcoind","geth","python")
    | summarize by RemoteIP;
DeviceNetworkEvents
| where TimeGenerated > ago(24h)
| where InitiatingProcessFileName in~ ("node","java","bitcoind","geth","python")
| where RemoteIP !in (toscalar(Baseline))
| where RemoteIP !startswith "10." and RemoteIP !startswith "192.168." and RemoteIP !startswith "172.16."
| summarize Connections=count(), FirstSeen=min(TimeGenerated), Ports=make_set(RemotePort)
    by DeviceName, InitiatingProcessFileName, RemoteIP, RemoteUrl
| order by FirstSeen desc;

// Hunt 3: Withdrawal-burst anomaly — alert when outbound transaction volume per hour exceeds 3x the 7-day hourly p95
// (Requires wallet/exchange telemetry ingested as a custom log table, e.g. WithdrawalEvents_CL)
WithdrawalEvents_CL
| where TimeGenerated > ago(1d)
| summarize HourlyVolume = sum(AmountUsd_d), TxCount = count() by bin(TimeGenerated, 1h)
| join kind=inner (
    WithdrawalEvents_CL
    | where TimeGenerated > ago(7d)
    | summarize HourlyVolume = sum(AmountUsd_d) by bin(TimeGenerated, 1h)
    | summarize P95 = percentile(HourlyVolume, 95)
) on $left.Dummy == $right.Dummy  // replace with cross-join pattern per your schema
| where HourlyVolume > 3 * P95
| project TimeGenerated, HourlyVolume, TxCount;

-- Bitget/DPRK intrusion hunt: persistence, SSH key tampering, suspicious processes
-- Persistence: systemd units and launch agents modified in the last 7 days
SELECT FullPath, Mtime, Size,
       read_file(filename=FullPath, length=4096) AS UnitSnippet
FROM glob(globs=['/etc/systemd/system/*.service',
                 '/usr/lib/systemd/system/*.service',
                 '/Library/LaunchDaemons/*.plist',
                 '/Library/LaunchAgents/*.plist',
                 os.path.expanduser('~') + '/Library/LaunchAgents/*.plist'])
WHERE Mtime > now() - 7 * 24 * 3600
  AND (UnitSnippet =~ '(curl|wget|bash -c|base64|/tmp/|/dev/shm/)' )

-- SSH authorized_keys / known_hosts modified recently (key theft or implant staging)
SELECT FullPath, Mtime, Size
FROM glob(globs=[os.path.expanduser('~') + '/.ssh/authorized_keys',
                 os.path.expanduser('~') + '/.ssh/id_*',
                 '/root/.ssh/authorized_keys'])
WHERE Mtime > now() - 7 * 24 * 3600

-- Processes with suspicious command lines on backend hosts
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(base64 -d|curl .*(http|https)|wget .*(http|https)|nc -|ncat |/dev/tcp/|chmod \+x)'
   OR Exe =~ '(/tmp/|/dev/shm/|/var/tmp/)'
ORDER BY CreateTime DESC

#!/usr/bin/env bash
# bitget-dprk-triage.sh — Rapid triage for exchange backend/signing hosts
# Checks: SSH key tampering, rogue persistence, tmp-exec processes, egress anomalies
set -euo pipefail
OUT="/var/tmp/triage_$(hostname)_$(date +%Y%m%d%H%M%S).log"
echo "=== Triage started $(date -u) ===" | tee "$OUT"

# 1) SSH keys modified in the last 14 days
echo -e "\n[1] Recently modified SSH material:" | tee -a "$OUT"
find /root/.ssh /home/*/.ssh -type f \( -name 'authorized_keys' -o -name 'id_*' \) \
  -mtime -14 -ls 2>/dev/null | tee -a "$OUT" || true

# 2) Systemd units created/modified in the last 14 days
echo -e "\n[2] Recently modified systemd units:" | tee -a "$OUT"
find /etc/systemd/system /usr/lib/systemd/system -name '*.service' \
  -mtime -14 -ls 2>/dev/null | tee -a "$OUT" || true
grep -rEl 'curl|wget|base64|/tmp/|/dev/shm/' /etc/systemd/system/*.service 2>/dev/null | tee -a "$OUT" || true

# 3) Processes executing from volatile filesystems
echo -e "\n[3] Processes running from /tmp, /dev/shm, /var/tmp:" | tee -a "$OUT"
for pid in $(ls /proc | grep -E '^[0-9]+$'); do
  exe=$(readlink "/proc/$pid/exe" 2>/dev/null || true)
  case "$exe" in
    /tmp/*|/dev/shm/*|/var/tmp/*) echo "PID $pid -> $exe" | tee -a "$OUT";;
  esac
done

# 4) Cron persistence review
echo -e "\n[4] Cron entries (system + users):" | tee -a "$OUT"
cat /etc/crontab 2>/dev/null | tee -a "$OUT" || true
ls -la /etc/cron.d/ /var/spool/cron/ 2>/dev/null | tee -a "$OUT" || true

# 5) Outbound connections from wallet/backend service users
echo -e "\n[5] Established outbound connections (non-RFC1918):" | tee -a "$OUT"
ss -tupn state established 2>/dev/null | \
  grep -vE '10\.|192\.168\.|172\.(1[6-9]|2[0-9]|3[01])\.' | tee -a "$OUT" || true

# 6) Enforce SSH hardening on signing hosts
echo -e "\n[6] Applying SSH hardening (password auth off, root login off):" | tee -a "$OUT"
SSHD=/etc/ssh/sshd_config
cp "$SSHD" "${SSHD}.bak.$(date +%s)"
sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' "$SSHD"
sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin no/' "$SSHD"
systemctl reload sshd 2>/dev/null || systemctl reload ssh 2>/dev/null || true

echo -e "\n=== Triage complete. Output: $OUT ===" | tee -a "$OUT"
echo "REVIEW the log before assuming clean; escalate anomalies to IR immediately."