TL;DR
- Bitget says two compromised third-party security products gave attackers a path into its wallet infrastructure and led to losses of about $387.5 million.
- In its latest update, Bitget explains how the hack bypassed the controls that had already blocked user-initiated withdrawals.
- Bitget has restored major withdrawals, replenished its protection fund above $300 million and continues tracing stolen assets.
Bitget says the hack that drained approximately $387.5 million from its wallet infrastructure began with the compromise of two third-party security products, at least one of them through a zero-day vulnerability. Preliminary forensic findings from Mandiant and SlowMist, released by Bitget on September 30, trace how the attacker moved from those appliances into the exchange’s wallet systems. Bitget says its private keys and cold wallets remained secure, based on its investigation so far.
Bitget updated the estimated value of stolen assets from $351.6 million to $387.5 million, reflecting a more complete accounting of affected transactions. The estimate now includes Zcash and Tron transfers that were not captured initially. The exchange says there were no additional losses after the incident was contained.
>>> Related: Bitget Freezes Withdrawals After $351.6M Wallet Hack
Compromised appliances opened a path to the wallet system
SlowMist traced the earliest malicious activity in the available logs to August 31. A zero-day vulnerability affected a service on one node of a security product that SlowMist calls Product A. Zero-day means the product’s maker did not know about the flaw, so no patch existed when the attacker used it. The attacker ran a hidden script under that service. The script read an environment variable containing a database password, which the attacker used to connect to the database. SlowMist found similar activity on two other nodes later in September.
Starting at 16:07 UTC on September 24, the attacker used an internal employee’s identity to access the management platform of a second product, Product B, and made three attempts to inject system commands. The attacker then uploaded malicious files.
Mandiant’s findings label two appliances A and B, which may be the same products SlowMist describes. They say the attacker installed a web shell, a hidden script that allows remote control of a server, on appliance B. The attacker opened a command-and-control connection, a channel for sending instructions to the compromised system. From there, the attacker moved into Bitget’s production wallet job server, which processes the exchange’s wallet operations, and deployed malicious packages.
SlowMist recovered a custom withdrawal tool from files the attacker had deleted. The tool was built around the wallet system’s withdrawal logic. It forged risk-control parameters in its own code and used them to build and submit withdrawal requests. Host logs show the program began running at 17:49 UTC, 42 minutes before the first transfer reached the attacker. CEO Gracy Chen said the attacker also deleted traces left by the commands, complicating the reconstruction of the incident.
On Bitget’s account, the theft did not depend on its private keys. Control of the wallet job server let the attacker issue withdrawals that the system treated as legitimate.
Bitget has not named the appliances or their vendor, or said whether the vendor has released a fix.
From two small transfers to $388 million
Chen said the attacker first tested Bitget’s controls at 18:31 UTC with two small unauthorized transfers of 0.84 ETH and 93 TRX. She said the transactions remained below existing risk thresholds before larger transfers followed.
Bitget’s updated timeline says its reconciliation system detected a significant discrepancy at 19:05 UTC. Its risk system then blocked user-initiated withdrawals across the platform. Mandiant’s report says Bitget’s monitoring detected the unauthorized transfers at 18:31 UTC, the time the timeline gives for the first transfers. However, the withdrawal block did not stop the attacker’s commands. Chen said 17 transactions across eight networks between 18:58 and 20:09 UTC moved about $361 million. SlowMist’s onchain records run from 18:31 to 21:23 UTC, a span of 2 hours and 52 minutes. After 21:22 UTC, the attacker tried to edit withdrawal records directly in the wallet database. He pushed two fabricated BTC withdrawal orders, which returned errors.
The full technical report will need to explain why the fraudulent commands kept executing for more than two hours after the block.
Bitget changes access and withdrawal controls
Bitget says it has restricted internal access to sensitive systems, added independent checks for withdrawals, and increased abnormal-activity monitoring. It also has begun reviewing how it assesses and deploys third-party security products. The exchange says the vulnerability identified within its own environment has been remediated.
Mandiant and SlowMist continue to support the forensic investigation and asset tracing. Bitget still describes that investigation as ongoing and says detailed findings will be disclosed through an official security report.
Protection fund replenished
Bitget reopened Bitcoin withdrawals on the Bitcoin and BNB Smart Chain networks on September 28. ETH followed on September 29, and USDT across Ethereum, BSC, Solana and Tron on September 30. Other supported tokens, fiat withdrawals and P2P services are due to return at 08:00 UTC on October 2.
Chen said on September 30 that the User Protection Fund had returned above $300 million, meeting her pledge to replenish it within a week using corporate reserves. Bitget’s latest Proof of Reserves snapshot, taken on September 29, showed an overall reserve ratio of 131% across 19 covered assets.
Bitget is still tracing assets stolen in the hack. Its bounty program offers participants 5% of eligible assets they help freeze, plus another 5% of funds they help recover successfully.
Circle and Tether have blacklisted an attacker-controlled wallet holding about 99,990 USDC and 218,023 USDT, freezing approximately $318,000 in stablecoins. The same wallet also held ETH, which the issuers cannot freeze through their token contracts.
NEAR Intents separately said it rejected more than $50 million in attempted transfers linked to the attackers, which then moved to other providers. It froze about $503,000 during execution.
Bitget says the vulnerability it identified in its own environment has been remediated, and withdrawals have reopened on that basis. The investigation behind that statement is still open. Mandiant bases its conclusions on the analysis completed so far, and Bitget says it will update its findings as the work continues. Two gaps remain: how the attacker got from the security products to the wallet server, and how activity first logged on August 31 went unnoticed until funds started leaving on September 24.
