Blockchain security firm SlowMist has traced the earliest activity behind Bitget's $388 million theft to a zero-day exploit used on Aug. 31, weeks before the Sept. 24 hot-wallet breach. The firm found the attacker infiltrated two third-party security products and used a custom tool to forge withdrawal requests.
SlowMist traced the earliest logged malicious activity tied to Bitget's $388 million theft to Aug. 31, when an attacker exploited a zero-day vulnerability in a third-party security product. Attackers then stole funds from Bitget's hot wallets on Sept. 24 UTC, moving assets to addresses they controlled across several blockchains.
Attacker moved through two security products
According to a SlowMist progress report, the attacker used a hidden script to access the database of what SlowMist called "Product A," after retrieving its password from an environment variable. Similar activity turned up on two other nodes on Sept. 23 and Sept. 25. On Sept. 25, the attacker also accessed the management platform of a second product, "Product B," using an internal employee's identity, then attempted to inject system commands, alter server configurations and upload malicious program files. SlowMist said its investigation remains ongoing as it examines how the attacker moved between the affected systems.
Custom tool forged withdrawal requests
SlowMist said it recovered a deleted, highly customized tool used to manipulate the wallet system's withdrawal process, which forged risk-control parameters, constructed withdrawal requests and invoked the withdrawal process itself. Onchain verification found the earliest confirmed transfer at 2:31 am UTC+8 on Sept. 25, when an attacker-controlled address received 93 TRX, followed 11 seconds later by 0.84 Ether on Ethereum. The compiled transfer records span about two hours and 52 minutes across multiple blockchains, extending to 5:23 am that day. The attacker also tried to modify withdrawal records directly in the wallet database and trigger additional Bitcoin withdrawals; two fabricated BTC withdrawal orders entered processing but returned errors, after which the attacker reviewed logs, checked order status and made further attempts.
Bitget still working to recover funds
In a Sept. 25 update, Bitget said about $387.5 million was transferred to attacker-controlled addresses across several networks. Bitget CEO Gracy Chen later told Cointelegraph that the breach stemmed from a vulnerability in a third-party security product that let the attacker obtain high-level internal credentials and issue fraudulent withdrawal commands, adding that Bitget's private keys and cold wallets were not compromised. Speaking on Cointelegraph's Chain Reaction, Chen said she was "not very optimistic" about fully recovering the roughly $388 million lost, pointing to the limited recovery from Bybit's 2025 hack as a reference point.
Source: Cointelegraph.com News
Trading involves risk.
Risk Disclaimer
