SlowMist Revealed Details of the Attack on Bitget’s Hot Wallets

• SlowMist found that malicious activity linked to two third-party security products was detected in Bitget’s systems before the asset theft.
• The attacker exploited a zero-day in one product and also gained access to another system using an employee’s credentials.

On September 25, 2026, crypto exchange Bitget brought in SlowMist to investigate the theft of assets from its hot wallets. As of September 29, the specialists identified malicious activity linked to two third-party security products, labeled in the report as Product A and Product B.

SlowMist determined that the earliest detected malicious activity occurred on August 31 on one of Product A’s nodes. The service was compromised via a zero-day vulnerability. The attacker then launched a stealth script within the service process, ran a command to read an environment variable containing the database password, and connected to it.

Researchers recorded similar activity involving stealth scripts on two more Product A nodes — on September 23 and September 25. The report notes that the environments of these services had been compromised even before the asset outflows began.

On the morning of September 25, the attacker also gained access to Product B’s management platform using an internal employee account. They attempted three times to inject system commands into Product B task parameters to write malicious files.

After that, via the command execution endpoint in the platform’s web interface, the attacker tried to change the server configuration, write a file to relay communications, and download and compile malicious program files in batches.

One of the key outcomes of the investigation was the recovery of files deleted by the attacker. Among them, SlowMist found a purpose-built asset-draining tool tailored to the wallet system’s logic.

The tool spoofed risk control parameters, generated withdrawal requests, and triggered the corresponding procedure. According to host logs, the malware began operating and carrying out the theft of crypto assets on the night of September 25.

As part of the first blockchain transfer confirmed by SlowMist, the attacker’s address received 93 TRX. Eleven seconds later, an address on the Ethereum network received 0.84 ETH. Confirmed asset transfers lasted about 2 hours and 52 minutes and took place across multiple blockchains.

After the transfers began, the attacker also tried to directly modify withdrawal records in the wallet’s database and run withdrawal jobs locally on the host. Logs showed that two fabricated bitcoin withdrawal orders entered processing, but both ended in errors.

After that, the attacker reviewed logs, checked the status of orders, and made new withdrawal attempts. 

SlowMist’s report does not specify the total amount of stolen assets, the full list of tokens, the names of Product A and Product B, or the identity of the attacker or group behind the incident. The company also did not determine the definitive initial compromise vector for the entire system.

Separately, SlowMist noted that, at the time of preparing the report, the investigation into how the attacker moved between the involved systems was still ongoing.

Read more about the Bitget hack — in the article:

Bitget Confirmed a $351.6M Hack. Analysts Suggested a Possible Link to North Korea

25.09.2026

Read now

Сообщение SlowMist Revealed Details of the Attack on Bitget’s Hot Wallets появились сначала на INCRYPTED.