SlowMist fingers Aug. 31 zero-day as the ghost in Bitget's $388M hot-wallet heist 🎯

Blockchain security firm SlowMist has traced the earliest logged malicious activity tied to Bitget's $388 million theft to Aug. 31, when an attacker exploited a zero-day vulnerability in a third-party security product. The funds were drained from Bitget's hot wallets on Sept. 24 (UTC) and moved to attacker-controlled addresses across several blockchains. SlowMist said its investigation identified malicious activity involving two third-party security products and a wallet application host, and that the probe remains ongoing.

According to a SlowMist progress report, the attacker used a hidden script to access the database of what the firm called "Product A," retrieving its password from an environment variable. Similar activity was later detected on two other nodes on Sept. 23 and Sept. 25. The dates and times in the report are in UTC+8. On Sept. 25, the attacker also accessed the management platform of a second security product, "Product B," using an internal employee's identity, then attempted to inject system commands, alter server configurations and upload malicious program files. SlowMist said it is still examining how the attacker moved between the affected systems.

SlowMist said it recovered a deleted, highly customized tool used to manipulate the wallet system's withdrawal process, which forged risk-control parameters, constructed withdrawal requests and invoked the withdrawal procedure. The firm's onchain verification found the earliest confirmed transfer at 2:31 am UTC+8 on Sept. 25, when an attacker-controlled address received 93 TRX, followed 11 seconds later by 0.84 Ether on Ethereum. The compiled transfer records spanned about two hours and 52 minutes across multiple blockchains, ending at 5:23 am that day. The attacker also attempted to modify withdrawal records directly in the wallet database and trigger additional Bitcoin withdrawals; SlowMist said two fabricated BTC withdrawal orders entered processing but returned errors, after which the attacker reviewed logs and made further attempts.

In a Sept. 25 update, Bitget said about $387.5 million was transferred to attacker-controlled addresses across several networks. Bitget CEO Gracy Chen told Cointelegraph the breach stemmed from a vulnerability in a third-party security product that allowed the attacker to obtain "high-level internal credentials" and issue fraudulent withdrawal commands, and that Bitget's private keys and cold wallets were not compromised. Bitget is still working to recover the stolen assets. Speaking on Cointelegraph's Chain Reaction, Chen said she was "not very optimistic" about fully recovering the roughly $388 million lost, citing the limited recovery from Bybit's 2025 hack as a reference point.