SlowMist: Bitget theft can be traced back to August 31, involving a zero-day vulnerability in a third-party product

PANews reported on September 30 that blockchain security firm SlowMist, commissioned by Bitget, launched an investigation into the September 25 hot wallet asset theft and released an interim investigation report. As of September 29, the investigation found malicious activity involving a specific third-party security product and the wallet application host, as well as a highly customized withdrawal tool used by the attacker.

Key findings include: the earliest malicious activity can be traced back to August 31, involving malicious activity exploiting a zero-day vulnerability in a third-party product; on September 25, someone posing as an internal employee gained unauthorized access to the third-party product's management platform; a customized withdrawal tool was discovered and obtained, designed to interact with the wallet system's withdrawal logic; on-chain activity began at 02:31 on September 25, involving transfer operations across multiple blockchains lasting approximately 2 hours and 52 minutes; this was followed by attempts to tamper with withdrawal records and trigger additional BTC withdrawal operations.