Bitget Hackers Lurk for 25 Days Before $388M Crypto Heist
Security report reveals attackers exploited zero-day flaw weeks before massive theft
1Extended system infiltration
Hackers first compromised Bitget's systems on August 31 through a zero-day vulnerability in a third-party security product, remaining undetected for 25 days. They accessed database credentials via environment variables, establishing persistent access. Slowmist's investigation revealed the attackers operated freely across multiple nodes before executing the theft, with additional breaches recorded on September 23 and 25. This prolonged access enabled them to study internal systems and prepare for the eventual fund transfer.
2Precise attack execution
The actual theft occurred during a concentrated 2-hour 52-minute window on September 24, with $228 million moved across seven blockchains in just 18 minutes. Attackers manipulated Bitget's internal approval system to authorize fraudulent transfers that appeared legitimate, without stealing private keys. They attempted to alter withdrawal records in the database, with failed BTC withdrawal attempts logged. The operation's precision suggests extensive reconnaissance during the weeks-long infiltration period.
3Sophisticated laundering techniques
Hackers employed advanced methods to obscure fund trails, using CoW Protocol for decentralized swaps and Chainflip for cross-chain transfers. Automated scripts routed stolen assets through multiple protocols including Thorchain and Uniswap. Despite Chainflip rejecting a direct deposit attempt, the hackers' system dynamically adapted by splitting funds across bridges and converting to bitcoin. Near Intents blocked $50 million of laundering attempts, freezing $503,000 while $166,000 slipped through.
4Third-party security failures
The breach originated not in Bitget's core systems but through compromised third-party security products (referred to as Product A and Product B). Attackers obtained high-level credentials through these vendor systems, highlighting supply chain vulnerabilities in crypto security. Slowmist hasn't disclosed the vendors' identities but confirms the attackers moved between systems in ways still being investigated. This echoes 2025's record $2 billion in North Korean crypto thefts.
5Exchange response measures
Bitget engaged Slowmist on September 25 and has since partially restored withdrawals, prioritizing bitcoin followed by ether and USDT. The exchange's $464 million User Protection Fund covers losses. However, the incident raises questions about security audits for third-party components. Bitget now recommends exchanges review logs dating back to August's end if using similar security stacks, as attackers may have targeted multiple platforms.
6Protocol accountability debate
The heist reignites discussions about decentralized protocols' responsibility in handling stolen funds, recalling previous Thorchain controversies. While some protocols like Near Intents actively blocked suspicious transactions, others served as effective laundering channels. The hackers' ability to bypass Chainflip's AML/KYT checks demonstrates how decentralized finance tools can be weaponized by sophisticated threat actors.
7North Korean connection
Slowmist's Trackagent tool identified scripts associated with North Korean hacking groups routing stolen funds. These groups set a $2 billion theft record in 2025 according to Fortune. The Bitget attack follows their established pattern of prolonged reconnaissance, supply chain attacks, and advanced laundering techniques. The involvement suggests state-sponsored actors continue targeting crypto exchanges as primary revenue sources.
8Industry-wide implications
This breach demonstrates how third-party vulnerabilities can compromise even exchanges with substantial security budgets. The 25-day dwell time before detection raises questions about monitoring capabilities across the sector. As North Korean groups refine their tactics, exchanges must implement more rigorous vendor audits and real-time anomaly detection, particularly for privileged access through security products.
Original article: Bitcoin News — Bitget Hackers Lurk for 25 Days Before $388M Crypto Heist