Bitget Loses $387.5M After Wallet Backend Breach and Transaction Data Manipulation

·1 views

Cryptocurrency exchange Bitget confirmed that approximately $387.5 million in digital assets was fraudulently transferred from its hot and warm wallets following a critical backend system compromise. Attackers manipulated transaction data to trigger legitimate authorization processes, enabling transfers across multiple blockchains including Ethereum-compatible chains, XRP Ledger, Zcash, and TRON. The specific initial access vectors and technical details of the signing system involved have not been publicly disclosed. Bitget has since frozen some of the stolen assets with the help of industry partners, and cybersecurity firms Mandiant and SlowMist are assisting with the ongoing investigation. North Korean threat actors have been identified by Bitget as candidates behind the attack, though this attribution has not been independently confirmed.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Migrating from Modern Events Calendar: Key Database Quirks Developers Must Know

Modern Events Calendar Lite was permanently removed from WordPress.org on May 11, 2022, for a guideline violation, though many sites continue running it via the developer's own distribution. Each event is stored as a custom post type called 'mec-events', with scheduling data held in post meta fields rather than the plugin's derived database tables. Developers migrating away from the plugin face several data pitfalls, including weekly repeat intervals stored in days instead of weeks, occurrence counts saved as one less than the user-entered value, and ISO-formatted weekday numbers that differ from PHP and JavaScript conventions. Advanced monthly repeat rules are stored as compact tokens such as 'Sun.1' or 'Fri.l', while location or organizer ID 1 is a placeholder meaning 'hide it' and should not be imported as a real venue. Auditing raw post meta with direct database queries is recommended before attempting any migration to avoid silently incorrect dates or repeat schedules.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

SentinelMind AI Agent Uses Persistent Memory to Cut Security Incident Resolution Time

A team built SentinelMind, an AI-powered incident response agent, as part of the HackwithHyderabad 3.0 hackathon. Unlike conventional security tools, SentinelMind uses a persistent memory layer called Hindsight to store details of every past incident, including the fix applied and time taken to resolve it. When a new alert arrives, the agent first searches its memory for similar past incidents and surfaces relevant solutions rather than starting from scratch. The team's Memory Impact dashboard showed resolution times dropping from over 40 minutes for early incidents to under 15 minutes once sufficient memory had accumulated. A key architectural decision was to have the LLM only explain figures derived from stored records, preventing the model from fabricating statistics and making the system more reliable.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Azure Resources Wiped in 7 Minutes as Storm-3168 Exploits Compromised Service Principals

Microsoft Security Research documented a critical cloud attack by threat group Storm-3168, in which two compromised Azure service principals carried out coordinated reconnaissance and destruction within a single victim tenant. One service principal conducted over 300 read operations across roughly 15.5 hours, while a second rapidly enumerated virtual machines and resource groups in approximately five seconds. About 16 hours after initial reconnaissance, the second principal deleted multiple storage accounts, a Key Vault, a Function App, and an App Service plan in a destructive sequence lasting around seven minutes. Approximately 30 minutes after the deletions, the attacker re-enumerated storage accounts and successfully issued over 30 ListKeys requests to harvest access credentials. Attempts to disable Site Recovery and backup protection locks were also observed, though those specific actions failed.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Strip GPS EXIF Data Before Publishing Images in Node.js Express Apps

A developer guide outlines a secure image publishing pipeline for Node.js Express applications that strips GPS and EXIF metadata before any upload becomes publicly accessible. The approach uses Sharp for re-encoding uploads as fresh JPEG or WebP files, ensuring metadata is not carried over from the original. After re-encoding, the output bytes are parsed and verified using the exifr library, and the publish job is rejected if any GPS location fields are still detected. The original upload is kept access-controlled as evidence, while only the verified, metadata-free derivative is stored and published. The method also enforces an 8 MB request size limit and includes unit tests covering phone photos with GPS tags, orientation-tagged screenshots, and images with no EXIF data.

0 comments Read more at DEV Community