Bitget Hacker Used Custom Withdrawal Tool to Steal $388M…

SlowMist has traced the earliest known malicious activity in Bitget's approximately $388 million breach to Aug. 31, more than three weeks before the exchange detected unauthorized withdrawals. The blockchain security firm said the attacker exploited a zero-day flaw in a third-party security product and later manipulated Bitget's wallet withdrawal infrastructure.

The findings focus on two third-party security products, identified as Product A and Product B, plus a wallet application host. Bitget said separate investigations by SlowMist and Mandiant broadly match the attack path it previously disclosed. Both probes concluded that compromised third-party security tools enabled unauthorized access to the exchange's wallet environment.

According to SlowMist, the Aug. 31 activity involved a zero-day in Product A. The attacker retrieved a database password from an environment variable and used a hidden script to access the product's database. Similar activity appeared on two additional nodes on Sept. 23 and Sept. 25, using UTC+8 timestamps. For Product B, SlowMist said the attacker entered its management platform on Sept. 25 using an internal employee identity, then attempted to inject system commands, change server configurations and upload malicious files. Bitget has previously said high-level internal credentials were obtained and fraudulent withdrawal instructions were issued without private keys being stolen.

Investigators recovered a deleted, highly customized program designed to interfere with the wallet system's withdrawal process. It could forge risk-control parameters, construct withdrawal requests and invoke the withdrawal workflow. The attacker also tried to modify withdrawal records directly in the wallet database and initiate additional Bitcoin withdrawals. Two fabricated BTC orders entered processing but returned errors, according to SlowMist, prompting the attacker to review logs and order statuses before making further attempts.

Onchain data places the first confirmed attacker-controlled receipt at 2:31 a.m. UTC+8 on Sept. 25, when an address received 93 TRX. Eleven seconds later, 0.84 ETH arrived on Ethereum. SlowMist's reconstructed transaction sequence lasted about two hours and 52 minutes across multiple blockchains. Bitget estimated roughly $387.5 million was sent to attacker-controlled addresses. The exchange said cold wallets were unaffected and ruled out private-key compromise.

The three-week gap between the first known compromise and the main drain suggests the attacker had time to study Bitget's systems. SlowMist said the path between Product A, Product B and the wallet environment remains under investigation, including whether earlier access was used for reconnaissance, credential collection or preparation of the custom withdrawal tooling.

Recovery and exchange operations

Recovery efforts are ongoing, but stolen assets continue to move. NEAR Intents said it blocked attempts to route more than $50 million linked to the breach and froze about $503,000 that entered its infrastructure. Chainflip said a broker rejected a transaction involving attacker-linked funds. On Wednesday, attacker-linked wallets moved around $3.9 million in stolen Zcash into the network's shielded pool.

Bitget is also restoring services. Its Sept. 29 proof-of-reserves snapshot showed a total reserve ratio of 131%, and the company said it had replenished its Protection Fund to more than $300 million. Withdrawals are returning in stages, with remaining tokens, fiat withdrawals and peer-to-peer services scheduled to return by Oct. 2.