The Bitget Hack Investigation: How a Zero-Day Led to a $388M Loss

A recent investigation by security firm SlowMist has pinpointed the origin of the massive hack targeting cryptocurrency exchange Bitget. The findings highlight critical vulnerabilities within the ecosystem of third-party service providers.

The Attack Timeline and Core Vector

The investigation traces the earliest malicious activity back to August 31. Rather than a direct assault on the exchange's core infrastructure, attackers exploited a previously unknown zero-day vulnerability in a third-party security product integrated into Bitget's systems. This vulnerability served as the initial foothold.

After nearly a month of潜伏 and lateral movement, the funds were ultimately siphoned from Bitget's hot wallets on September 24 (UTC), and transferred to multi-chain addresses controlled by the attackers.

A Sophisticated Supply Chain Attack

The methodology underscores the complexity of modern supply chain attacks. The report details involvement across two third-party security products and a wallet application host:

  • Attackers first used a hidden script to extract data from the database of a service referred to as "Product A."
  • Using credentials obtained, they then gained access to the management platform of another service, "Product B," by impersonating an internal employee.

This "island-hopping" tactic allowed them to bypass certain direct defenses, targeting weaker links in the external supply chain. SlowMist noted the recovery of custom tools used by the attackers to manipulate the withdrawal process, which was key to reconstructing the attack.

Exchange Response and Security Implications

In a statement, Bitget CEO Gracy Chen attributed the breach to the third-party security product, emphasizing that the exchange's core private keys and cold wallet storage were not compromised. This assurance aimed to maintain user confidence regarding the safety of primary assets.

The incident serves as a stark reminder: in the interconnected crypto ecosystem, any third-party service can become the weakest link. While exchanges must fortify their own defenses, continuous and rigorous auditing of partners and vendors is equally imperative. An undetected zero-day in a peripheral service can trigger catastrophic chain reactions.