Déjà Vu, Lazarus Crew: $387.5m Bitget Exploit Repeats a Pattern

What it is

Galaxy Research's analysis of the September 2025 Bitget exploit ($387.5m across 11 chains), framing it as the latest instance of a specific attack pattern: compromising the transaction-approval pipeline rather than private keys. The forensic detail comes from SlowMist's investigation.

How it works

Attackers exploited a zero-day in two unnamed third-party security products used by Bitget ("Product A" and "Product B") to obtain high-level internal credentials. SlowMist found multiple "nodes" of Product A infected with malicious code from this zero-day. With that access, attackers inserted fraudulent withdrawal commands directly into Bitget's wallet backend, then deleted those commands after funds were sent — erasing the normal audit trail. SlowMist traced the earliest malicious activity to August 31 and recovered a custom withdrawal tool built around Bitget's own withdrawal logic. Private keys and cold wallets were never touched.

Preconditions / Affected

Applies to exchanges/custodians relying on third-party vendor software embedded in their wallet withdrawal backend. The attack requires compromising that vendor integration (via zero-day) to reach a privilege level that can write withdrawal commands — not the signing keys themselves. Bitget has not disclosed the identity of Product A/B.

What to do

The piece gives no vendor-specific patch guidance (vendors are still unnamed), but states the actionable signal for detecting this class of attack: a partial, uneven drain — rather than a full sweep of available funds — is the fingerprint of a compromised approval pipeline rather than a stolen key. SlowMist noted two forged BTC withdrawal orders errored out, which is why the loss wasn't larger; monitoring for failed/anomalous withdrawal-order attempts alongside successful ones is the kind of signal this case illustrates. The piece also flags that stolen funds were laundered through THORChain (which declined to block transfers, citing decentralization), while NEAR Intents' Omni infrastructure did block ~$50m and froze ~$503k mid-execution the same week — showing an intermediary layer can be a chokepoint for response as well as an attack surface.

Caveats

The vendor names ("Product A"/"Product B") are not disclosed, so no one can act on a specific vendor patch yet. The NEAR Intents $3.8m exploit (same week, hit via its deposit/withdrawal infrastructure) is explicitly not attributed to Lazarus by the author — it's offered as a pattern observation, not a confirmed link. Attribution to DPRK rests on IP behavior and wallet-overlap analysis by Elliptic/TRM, not independently verified by Galaxy.