SlowMist, engaged by Bitget, reports that the September 25 hot wallet theft involved a zero-day vulnerability in a third-party security product. The attacker used an internal employee identity to access a third-party management platform on September 25 and deployed a customized withdrawal tool interacting with the wallet system's withdrawal logic. On-chain movement began at 02:25 UTC+8 and spanned roughly 2 hours 52 minutes across multiple blockchains, followed by attempts to manipulate withdrawal records and trigger further BTC withdrawals. How the attacker moved between systems remains under investigation.

AI summary of the linked source — not editorial content.

Story signal · how it spread on X · via Elfa

as of
Spread
i
Distinct X and Telegram accounts Elfa counted behind this story’s reports, summed over the thread. Not posts, not impressions.
38 accounts

10 reports
first post
Leviathan +4.1 h later

Thread · 8 of 34 events · started 24 Sep 20:14 · 1 mitigation · 1 confirmed · 1 consequence · last update 14 Oct 15:05
  1. Thread startBitget reportedly hacked as more than $100 million in assets moves and withdrawals are blocked258 acc.
  2. UpdateBitget to resume withdrawals in phases after September 24 security incident28 acc.
  3. UpdateBitget hack funds are flowing through THORChain, generating fees for its claims system50 acc.
  4. MitigationNEAR Intents’ SHIELD blocks most attempted laundering of funds from the $387.5M Bitget hack6 acc.
  5. UpdateBitget investigation identifies zero-day exploitation and a customized tool used in the $387 million theft3 acc.
  6. Leviathan published this article
  7. ConfirmedTwo Web3 security reports cite Bitget’s September breach among major losses2 acc.
  8. ConsequencePosts argue Bitget hack tracing exposes limits of Zcash privacy versus Monero7 acc.
  9. UpdateBitget writes off its $388 million hack loss as fund recovery prospects remain low2 acc.

All times UTC.

Cited posts

  • @SlowMist_Team SlowMistFirst reportOn X ↗

    @bitget has engaged SlowMist’s security team to investigate the September 25 hot wallet asset theft. As of September 29, our investigation has identified malicious activity involving certain third-party security products and a wallet application host, as well as a highly…

  • @bitgetOn X ↗

    We are very grateful for SlowMist's quick response and professionalism in helping us investigate this incident thoroughly. They have shared their findings on the September 24 security incident. Their investigation identified malicious activity involving third-party security… https://t.co/tlAGAkIMJn

  • @ChainCatcher_ ChainCatcherOn X ↗

    慢雾披露 Bitget 调查进展：攻击者伪造风控参数提币 针对 Bitget 此前披露的约 3.875 亿美元安全事件，慢雾发布调查进展报告，梳理了第三方安全产品遭入侵、定制工具提币及后续 BTC 提币尝试等发现。 主要发现如下，时间均为北京时间： 1.最早的入侵痕迹可追溯至 8 月 31 日。 第三方安全产品 A… https://t.co/f6Vn5bpdBN

Show 3 more cited posts
  • @dirkcryptodiggy Dirk Crypto DiggyOn X ↗

    it's very easy to see here. $ZEC is NOT private. $XMR is. That's why they ban one and not the other. https://t.co/y1rKQCwXob

  • @ctbutt114 C. ₿uttOn X ↗

    I'm starting to think $ZEC is useless as a privacy token. Not only did Bitget hacker get identified easily (with no real info on HOW), they're now tracing the swaps through Tornado Cash INTO SHIELDED ZEC. Still sticking with $XMR. https://t.co/RzfWRA4IRT

  • @loffyhl loffy.hl 🇵🇹On X ↗

    so if $ZEC hacked funds can be traced, that makes $XMR the real privacy btc right

32 more accounts posted about this · 2 Telegram channels (no public link)

Social-monitoring data, not investment advice Elfa post text from Xas of

Explore the topic

Loading related coverage…

Explore the full feed

Comments

Loading comments…