Bitget says attackers reached its cryptocurrency wallet systems through third-party security appliances before stealing $387.5 million. New findings from SlowMist and Mandiant place the Bitget hack within a longer intrusion, with the earliest suspicious activity appearing in logs from August 31.
The exchange has not publicly identified the affected products. However, it says the investigations linked the compromise to zero-day exploitation involving two security appliances.
Evidence Points to Access Weeks Before the Theft
SlowMist’s analysis found that an attacker exploited a vulnerable service on one appliance node to run a concealed script.
The attacker then retrieved a database password from an environment variable and used it to connect to the database. Investigators observed similar script activity on two additional nodes on September 23 and September 25.
Meanwhile, Mandiant identified unauthorized privileged access to two third-party security appliances on September 24. Its findings describe how the attacker established a foothold and moved toward the exchange’s wallet infrastructure.
Together, the reports provide a clearer sequence of events leading up to the theft. Nevertheless, the earliest available log entry does not necessarily establish when the intrusion began.
Compromised Appliances Provided a Route to Wallet Systems
According to Mandiant, the attacker installed a web shell on one appliance and established a connection to external command infrastructure.
That persistent access subsequently allowed movement to Bitget’s production wallet job server, where the attacker deployed malicious software.
Investigators also identified a custom withdrawal tool used during the cryptocurrency theft on September 25.
Bitget CEO Gracy Chen previously said the intruders manipulated transaction data inside a critical wallet backend system. As a result, the exchange’s authorization process approved transfers from compromised hot and warm wallets.
The findings describe an attack against the systems supporting withdrawals, rather than a failure of the underlying blockchains.
Nearly Three Hours of Transfers Across Multiple Networks
SlowMist recorded fraudulent transfers between 02:31 and 05:23 UTC+8, a period just short of three hours.
The operation affected Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC, and Base. Stolen assets included ETH, XRP, BNB, AVAX, USDT, USDC, and other tokens.
After detecting unauthorized activity, Bitget suspended withdrawals. The exchange ultimately reported losses totaling $387.5 million.
However, the latest disclosure focuses on how the attackers entered and navigated its infrastructure. It does not name the security vendors or provide public details of the exploited vulnerabilities.
Bitget Hack Attribution Remains the Exchange’s Assessment
Chen has attributed the attack to suspected North Korean hackers, citing IP behavior and blockchain transaction analysis.
However, that attribution represents Bitget’s assessment. The investigation details described here do not establish independent confirmation of the attackers’ identity.
The distinction matters because evidence explaining an intrusion does not automatically identify the people responsible.
Recovery Program Offers a Five Percent Reward
Bitget has also introduced a bounty program for assistance recovering or freezing the stolen cryptocurrency.
The program offers a 5% reward for qualifying help. Meanwhile, the unnamed security products and undisclosed vulnerability details leave questions about possible exposure beyond the exchange.
The published findings establish a path from compromised security appliances to wallet operations, but they do not yet provide a complete public account.
0 responses to “Bitget Hack: Security Appliance Zero-Day Linked to $387.5 Million Theft”