SlowMist Releases Update on Bitget Incident Investigation: Malicious Activity Traced to Late August, Involves Third-Party Product Zero-Day Vulnerability

TechFlow reported that on September 30, the SlowMist security team, commissioned by Bitget, released preliminary investigation findings regarding the hot wallet asset theft incident that occurred on September 25. The report indicates that the earliest malicious activity began on August 31, when attackers exploited a zero-day vulnerability in a third-party security product node to breach the service environment. In the early hours of September 25, attackers used compromised internal accounts to infiltrate another security product management platform, uploading customized malicious tools in batches to forge withdrawal parameters and trigger the withdrawal process. The first abnormal on-chain transfer occurred at 02:31 on September 25, with fund transfers continuing for nearly three hours across multiple blockchains. Investigation remains ongoing; SlowMist has not yet disclosed the attacker’s identity, nor announced the final scale of losses or the scope of affected systems.