SlowMist traces $388 million Bitget theft to third-party zero-day exploit

SlowMist traced the earliest logged malicious activity linked to Bitget's $388 million theft to Aug. 31, when an attacker exploited a zero-day vulnerability in a third-party security product. Attackers stole funds from Bitget's hot wallets on Sept. 24 UTC and transferred assets to addresses they controlled across several blockchains. SlowMist's investigation identified malicious activity involving two third-party security products and a wallet application host. SlowMist said the attacker used a hidden script to access the database of "Product A" after retrieving its password from an environment variable. SlowMist later detected similar activity on two other nodes on Sept. 23 and Sept. 25. SlowMist said the attacker accessed the management platform of "Product B" on Sept. 25 using an internal employee's identity. SlowMist said the attacker then attempted to inject system commands, alter server configurations and upload malicious program files. SlowMist recovered a deleted, highly customized tool used to manipulate the wallet system's withdrawal process. The tool forged risk-control parameters, constructed withdrawal requests and invoked the withdrawal process. SlowMist's onchain verification found the earliest transfer verified to date at 2:31 am UTC+8 on Sept. 25, when an attacker-controlled address received 93 TRX. The address received 0.84 Ether on Ethereum 11 seconds later. The compiled transfer records spanned about two hours and 52 minutes across multiple blockchains, ending at 5:23 am UTC+8 that day. The attacker also tried to modify withdrawal records directly in the wallet database and trigger additional Bitcoin withdrawals. SlowMist said two fabricated BTC withdrawal orders entered processing but returned errors. SlowMist said the attacker then reviewed logs, checked order status and made further attempts. Bitget said in a Sept. 25 update that about $387.5 million had been transferred to attacker-controlled addresses across several networks. Bitget CEO Gracy Chen said a vulnerability in a third-party security product allowed the attacker to obtain high-level internal credentials and issue fraudulent withdrawal commands. Chen said Bitget's private keys and cold wallets were not compromised. SlowMist said its investigation remains ongoing, including how the attacker moved between the affected systems. Bitget is still trying to recover the stolen assets. Chen said she was not very optimistic about fully recovering the roughly $388 million lost, citing the limited recovery from Bybit's 2025 hack as a reference point.