Bitget Users Lost $387.5M in Wallet Attack

Bitget users lost access to funds after attackers moved about $387.5 million from the exchange’s hot and warm wallets. The theft was not a sudden compromise: SlowMist traced malicious activity to an undisclosed third-party security product on Aug. 31, weeks before the transfers began on Sept. 24 UTC.

The attack began before the theft

SlowMist found activity involving two unidentified third-party security products and a wallet application host. Its earliest logged malicious activity connected to the theft occurred on Aug. 31, when an attacker exploited a zero-day vulnerability in one of those products.

That gap matters because the firms have not explained how long the attacker maintained access, or whether the activity on Aug. 31 was directly connected to every later action reported by investigators. SlowMist and Mandiant have both described their findings as interim reports, which means the current account of the attack is not yet complete.

The attacker used a hidden script to reach the database of what SlowMist called “Product A,” after retrieving its password from an environment variable. Similar activity was detected on two other nodes on Sept. 23 and Sept. 25, suggesting that the attacker was still probing the systems shortly before the transfers began.

Bitget’s signing system approved withdrawals

On Sept. 24, the attacker accessed the management platform for a second product, called “Product B,” using an internal employee’s identity. SlowMist said the attacker then tried to inject system commands, change server configurations and upload malicious files, all actions that could give the attacker control over systems connected to the exchange.

GoPlus Security concluded that Bitget’s own signing system approved the transfers. The largest wave, about $185 million, moved in roughly one minute at 19:16 UTC on Sept. 24, which is significant because the approval process that should have stopped suspicious withdrawals instead treated the transfers as valid.

SlowMist recovered a deleted, heavily customized tool that forged risk-control parameters, built withdrawal requests and invoked the withdrawal process. Two fabricated Bitcoin withdrawal orders entered processing but returned errors, while logs showed the attacker checking order records and retrying, according to the security researchers.

Transfers lasted nearly three hours

The first verified on-chain outflow was 93 TRX at 2:31 am UTC+8 on Sept. 25, followed 11 seconds later by 0.84 ETH on Ethereum. The compiled transfer records covered about two hours and 52 minutes, ending at 5:23 am UTC+8.

The first transfers began at 18:31 UTC on Sept. 24, which is 2:31 am UTC+8 on Sept. 25. That timing matches the minute Bitget said it detected unauthorized transfers, and the differing date labels in published accounts come from the time zones used.

Bitget has said the incident did not compromise its private keys or cold wallets. It also said the separately operated Bitget Wallet self-custody product was not affected, though that does not mean all user exposure was limited to the exchange’s own systems, because the funds were taken from hot and warm wallets and sent across several blockchains.

What Bitget has confirmed

Bitget first estimated the loss at $351.6 million. On Sept. 25, it raised the figure to about $387.5 million after adding Zcash and TRON transfers from the same attack window, and the exchange said the revision was not a second breach. It also launched a 5% bounty for frozen funds.

The exchange has said its User Protection Fund, which held more than $464 million at the time, would cover the loss. It reopened Bitcoin withdrawals on Sept. 28, while its wider schedule put USDT withdrawals at Sept. 30, with remaining tokens, fiat and P2P transactions due Oct. 2.

Bitget reopened Bitcoin withdrawals after the incident, but the underlying cause remains only partly identified. Bitget CEO Gracy Chen has said a vulnerability in a third-party security product gave the attacker high-level internal credentials, which were then used to issue fraudulent withdrawal commands.

Recovery and remaining unknowns

Chen has said she is not very optimistic about fully recovering the roughly $388 million. SlowMist’s MistTrack has identified suspected laundering routes through CoW Protocol orders, Chainflip contracts, bridges to Bitcoin and CoinJoin, according to the researchers’ analysis of the transfers.

SlowMist said Chainflip has tried to block some flows, but automated splitting across bridges is outpacing AML and KYT checks. In practical terms, that means the stolen assets may continue moving even after some routes are blocked, and investigators have not yet provided a complete recovery picture.

Attribution to North Korea remains a theory from Bitget, Elliptic and on-chain investigators, not a confirmed government finding. No government has formally attributed the attack.

SlowMist and Mandiant have not named the vendors behind Product A or Product B. They also have not identified who built the zero-day, or how the internal employee identity was obtained or forged, and Bitget expects to publish a fuller security report, but until those gaps are filled, the central claim remains that a vulnerable third-party security product opened a path into Bitget’s wallet environment.