Lilian Cariou

The Bitget hack resulted in approximately $387.5 million in stolen assets after attackers exploited a zero-day in a third-party security product and compromised Bitget’s wallet infrastructure. Rather than stealing private keys, the attackers forged withdrawal requests that Bitget’s own signing system accepted as legitimate, allowing valid signatures over unauthorized transfers.

This article examines five security gaps through real-world exploits involving Cetus, Aftermath Finance, Typus Finance, and Scallop. It also explores how developers can use testing and formal verification to check critical properties, detect vulnerabilities, and strengthen the security of Sui applications.

A vulnerability in the Soroban SDK caused equivalent cryptographic values to compare as different, potentially allowing double withdrawals in affected contracts. This case study explores CVE-2026-32322, shows how Certora's Sunbeam Prover reproduces the issue with a simple formal verification rule, and explains what developers should check when using affected SDK versions.

On September 24, 2026, Payy lost $1.92 million in USDC after forged zero-knowledge proofs passed its verifier. This analysis reconstructs the Barretenberg soundness bug, the fix released 73 days before the exploit, and a Lean model demonstrating the missing constraint.

Moonwell checked its 20M MAMO supply cap on deposits only. The attacker deposited 15M MAMO, sent 53M more straight to the market, pumped the price and borrowed $11M. We gave AutoProver the code as it stood three days before the attack.