SlowMist says it has traced key parts of the compromise behind Bitget’s reported $388 million hot-wallet theft, including how attackers moved through multiple components tied to third-party security products and used a custom withdrawal tool to extract funds.
In a progress update published with an incident-response report, SlowMist links the earliest observed malicious activity to Aug. 31, when an attacker allegedly exploited a zero-day flaw in a third-party security product. The firm later identified additional suspicious actions across other affected nodes and described attempts to execute fraudulent withdrawals across several blockchains.
Key takeaways
- SlowMist points to an Aug. 31 zero-day exploit in a third-party security product as the start of the logged intrusion chain.
- According to SlowMist’s findings, attackers used a hidden script to access a “Product A” database using a password pulled from an environment variable.
- A custom tool was used to manipulate Bitget’s withdrawal process by forging risk-control parameters and triggering withdrawals.
- SlowMist says the breach included accessing a “Product B” management platform using an internal employee identity, followed by attempts to alter systems and upload malicious files.
- The investigation is ongoing, with SlowMist still assessing how attackers moved between compromised systems.
From an initial zero-day to broader footholds
SlowMist said the earliest logged malicious activity connected to the Bitget theft dates back to Aug. 31. The firm attributed the first step to an attacker exploiting a zero-day vulnerability affecting a third-party security product.
SlowMist’s investigation then tracked theft activity from Bitget’s hot wallets on Sept. 24 (UTC). From there, the attacker transferred assets to addresses they controlled across multiple blockchains. SlowMist also reported malicious activity involving two third-party security products and a wallet application host.
In the progress report, SlowMist described how the attacker targeted the database of what it calls “Product A.” The attacker allegedly used a hidden script after retrieving the database password from an environment variable. SlowMist said similar activity was later observed on two other nodes on Sept. 23 and Sept. 25. The timestamps in the report are given in UTC+8, according to SlowMist.
The firm said its work continues as it examines how the attacker transitioned between the affected systems during the incident.
Attackers used access tied to identity and attempted server manipulation
On Sept. 25, SlowMist said the attacker accessed the management platform for a second security product—referred to as “Product B”—using an internal employee’s identity.
SlowMist reported that, after gaining access, the attacker attempted to inject system commands, alter server configurations, and upload malicious program files. These actions suggest the intrusion was not limited to data theft or passive compromise, but extended to active attempts to influence systems that could affect withdrawal operations.
SlowMist emphasized that it is still investigating the incident’s full progression, including the mechanism used to move between the affected nodes.
A customized withdrawal mechanism and early on-chain traces
SlowMist said it recovered a deleted, highly customized tool designed to manipulate the wallet system’s withdrawal workflow. The firm described the tool as capable of forging risk-control parameters, building withdrawal requests, and invoking the withdrawal process.
On-chain verification in SlowMist’s reporting identified the earliest transfer it could verify to date. The first confirmed movement linked to the attacker-controlled activity occurred at 2:31 a.m. (UTC+8) on Sept. 25, when an attacker-controlled address received 93 TRX. Eleven seconds later, 0.84 Ether was received on Ethereum. SlowMist said the compiled transfer records across chains ran for roughly two hours and 52 minutes, extending to 5:23 a.m. that day.
Beyond standard withdrawal manipulation, SlowMist said the attacker also attempted to modify withdrawal records directly within the wallet database and initiate additional Bitcoin withdrawals. The firm reported that two fabricated BTC withdrawal orders entered processing but ultimately returned errors. After reviewing logs and checking order status, SlowMist said the attacker made further attempts.
Bitget has previously tied the incident to third-party access. In a Sept. 25 update covered earlier, Bitget said about $387.5 million had been transferred to attacker-controlled addresses across multiple networks. In an interview with Cointelegraph, Bitget CEO Gracy Chen said the breach stemmed from a vulnerability in a third-party security product that enabled the attacker to obtain “high-level internal credentials” and issue fraudulent withdrawal commands. Chen also said Bitget’s private keys and cold wallets were not compromised.
What remains uncertain as recovery efforts continue
SlowMist’s latest progress update underscores how multi-layered the intrusion appeared to be: an initial exploit, access to security-product infrastructure, and ultimately a purpose-built withdrawal manipulation tool that appears to have bridged the gap between compromised systems and on-chain outflows.
Bitget continues to pursue asset recovery. Speaking on Cointelegraph’s Chain Reaction, Chen said she was “not very optimistic” about fully recovering the roughly $388 million lost, referencing the limited recovery from Bybit’s 2025 hack as a benchmark.
Readers should watch for further clarification on two points: how the attacker moved between the “Product A” and “Product B” environments and what additional on-chain or internal records SlowMist identifies as the investigation narrows from suspected compromise paths to a confirmed step-by-step sequence.
Be the first to comment