SlowMist has traced the earliest known activity connected with the theft of roughly $388 million from Bitget’s hot wallets to Aug. 31, identifying what it described as a zero-day attack against a third-party security product. The investigation indicates that the breach involved more than the exchange’s wallet infrastructure: attackers also accessed another security platform and a wallet application host before using a customized tool to generate fraudulent withdrawals.
The funds were taken on Sept. 24 UTC and moved to addresses controlled by the attackers across several blockchains. According to Cointelegraph, Bitget later said that approximately $387.5 million had been transferred. The exchange’s chief executive, Gracy Chen, said the attackers exploited a vulnerability in an external security product to obtain high-level internal credentials and issue unauthorized withdrawal commands. She said Bitget’s private keys and cold wallets were not compromised.
Investigation points to third-party systems
SlowMist’s progress report places the first logged malicious activity on Aug. 31. The attacker reportedly used a concealed script to enter the database of a security product referred to as “Product A.” The password was obtained from an environment variable, a form of system-stored configuration information that can be used by applications to access services.
Similar activity was subsequently found on two other nodes on Sept. 23 and Sept. 25. The report uses UTC+8 for its timestamps. SlowMist said the investigation is still underway and that it continues to examine how the attacker moved between the affected systems.
On Sept. 25, the attacker also gained access to the management platform of a second security product, called “Product B” in the report. SlowMist said an internal employee’s identity was used in that access. The attacker then tried to inject system commands, change server configurations and upload malicious program files.
The sequence is significant because it suggests that the incident was connected to weaknesses in supporting security and wallet-management systems, rather than involving a direct compromise of Bitget’s private keys or cold-storage wallets. Hot wallets are connected to systems used for transactions and are generally designed to support more immediate withdrawals, while cold wallets are kept offline or otherwise separated from routine online operations.
Customized tool targeted withdrawals
SlowMist said it recovered a deleted, highly customized program designed to manipulate the wallet system’s withdrawal workflow. The tool could falsify risk-control parameters, build withdrawal requests and call the process that executes those requests.
The security firm’s onchain review identified the earliest transfer verified so far at 2:31 a.m. UTC+8 on Sept. 25. At that time, an address controlled by the attacker received 93 TRX. Eleven seconds later, the same investigation recorded a transfer of 0.84 Ether on Ethereum. Transfer records compiled by SlowMist covered approximately two hours and 52 minutes across multiple blockchains, ending at 5:23 a.m. that day.
The attacker also attempted to alter withdrawal records directly in the wallet database and initiate additional Bitcoin withdrawals. Two fabricated Bitcoin withdrawal orders entered processing but produced errors. SlowMist said the attacker then examined logs, checked the status of the orders and made further attempts.
Bitget’s Sept. 25 update put the amount transferred to attacker-controlled addresses at about $387.5 million. Chen later told Cointelegraph that the company’s internal credentials had been obtained through the third-party vulnerability and used to create fraudulent withdrawal instructions.
Bitget is continuing efforts to recover the assets. Chen said on Cointelegraph’s Chain Reaction program that she was “not very optimistic” about recovering the full amount, citing the limited recovery from Bybit’s 2025 hack as a reference. SlowMist has not completed its investigation into how the attacker moved through the affected systems.
Moneyiar market picture
Moneyiar market data at 09:18 on Oct. 1, 2026, shows mixed performance among the tracked assets:
- Lighter (LIT): $4.0207127733, up 4.88% over 24 hours but down 23.13% over seven days.
- Plasma (XPL): $0.0975508658, up 0.84% in 24 hours and 10.61% over seven days.
- OriginTrail (TRAC): $0.476075372, up 12.95% over 24 hours and 32.51% over seven days.
- Walrus (WAL): $0.0345494265, up 0.9% over 24 hours and 6.7% over seven days.
These market figures describe the prices and percentage changes of the four tracked assets at the stated time; they do not measure the financial impact of the Bitget incident.
