Financial platform incident response updates confirm that a major digital asset theft resulted from an unpatched zero day flaw residing in third party security inspection software. Threat actors leveraged the zero-day to bypass internal access boundaries and compromise backend wallet authorization services.
The breach, which resulted in the loss of 387.5 million dollars in digital assets, occurred after adversaries exploited a zero-day vulnerability in third-party security inspection appliances protecting exchange application servers. Threat actors leveraged the initial access to manipulate internal RPC calls, tricking automated transaction signing daemons into approving unauthorized high-value transfers across multiple blockchain networks. Exchange engineering teams confirmed that internal security inspection tools have since been isolated and patched.
Subverting third-party security software highlights critical third-party supply chain risks across enterprise cloud environments. When security inspection gateways contain unpatched zero-day flaws, adversaries can exploit trusted inspection channels to bypass internal network segmentation and subvert backend authorization workflows.
– Conduct immediate inventory and security auditing of all third-party security inspection appliances and security daemons.
– Implement mutual TLS authentication and out-of-band multi-party signing rules for automated transaction services.
– Inspect internal application server logs for anomalous RPC calls originating from security inspection subnet ranges.
– Enforce continuous zero-trust non-human identity governance across internal microservice communication pathways.
Enterprise security architecture requires multi-tiered authorization controls and continuous zero-trust validation to ensure third-party security product vulnerabilities cannot lead to total backend compromise. #CodeDefence #Bitget #CryptoSecurity #ZeroDay #SupplyChain #FinTech #CloudSecurity #IncidentResponse
/
