SlowMist traces Bitget hack activity to Aug. 31 zero-day exploit
SlowMist identified malicious activity weeks before the Bitget theft, involving a zero-day vulnerability, two security products and a custom withdrawal tool.
SlowMist traced the earliest logged malicious activity linked to Bitget’s $388 million theft to Aug. 31, when an attacker exploited a zero-day vulnerability affecting a third-party security product.
Attackers stole the funds from Bitget’s hot wallets on Sept. 24 (UTC), transferring assets to addresses they controlled across several blockchains. SlowMist’s investigation identified malicious activity involving two third-party security products and a wallet application host.
According to a SlowMist progress report, the attacker used a hidden script to access the database of what SlowMist called “Product A,” after retrieving its password from an environment variable. Similar activity was later detected on two other nodes on Sept. 23 and Sept. 25. The dates and times in the report are in UTC+8.
On Sept. 25, the attacker also accessed the management platform of a second security product, which SlowMist called “Product B,” using an internal employee’s identity. SlowMist said the attacker then attempted to inject system commands, alter server configurations and upload malicious program files.
SlowMist said its investigation remains ongoing and that it is still examining how the attacker moved between the affected systems.
The security company said it recovered a deleted, highly customized tool used to manipulate the wallet system’s withdrawal process. The tool forged risk-control parameters, constructed withdrawal requests and invoked the withdrawal process.
SlowMist’s onchain verification found the earliest transfer verified to date at 2:31 am UTC+8 on Sept. 25, when an attacker-controlled address received 93 TRX, followed 11 seconds later by 0.84 Ether on Ethereum. The compiled transfer records spanned about two hours and 52 minutes across multiple blockchains, extending to 5:23 am that day.
The attacker also tried to modify withdrawal records directly in the wallet database and trigger additional Bitcoin withdrawals. SlowMist said two fabricated BTC withdrawal orders entered processing but returned errors, after which the attacker reviewed logs, checked order status and made further attempts.