Security firm SlowMist has linked the theft of $388 million from Bitget to a zero-day vulnerability discovered on August 31. The exploit targeted a third-party security product, allowing attackers to obtain high-level internal credentials and bypass security measures.
The malicious activity began on August 31, followed by unauthorized access to two security products, referred to as Product A and Product B, between September 23 and September 25. Attackers used internal employee identities and hidden scripts to manipulate server configurations and database records.
On September 24, attackers initiated the theft from Bitget hot wallets. A custom tool was deployed to forge risk-control parameters and execute fraudulent withdrawal requests across multiple blockchains. The process spanned approximately two hours and 52 minutes.
Bitget CEO Gracy Chen confirmed that private keys and cold wallets remained secure during the breach. The company is currently attempting to recover the stolen funds, although the CEO expressed limited optimism regarding the total recovery of the assets.
Investigations by SlowMist are ongoing as the firm analyzes how the attacker moved between systems. The security company noted that the attacker attempted to modify withdrawal logs and trigger additional Bitcoin transfers, which ultimately failed due to system errors.
