Bitget — Rekt

What it is

Technical attack chronology and timeline details for the Bitget breach, drawn from Mandiant's and SlowMist's incident-response status reports plus researcher reconstructions — material the existing summary doesn't carry: specific timestamps, the privilege-escalation path, and dollar/time breakdowns of the drain and laundering.

How it works

SlowMist traces the earliest malicious activity to August 31 (not September 24): a hidden script read an environment variable holding a database password on "Product A," a third-party security appliance, then repeated on September 23 and 25. Mandiant says the attacker gained privileged access to two such appliances on September 24, planted a web shell, established C2, then moved laterally to Bitget's production wallet job server and deployed malicious packages. SlowMist separately logs the attacker injecting commands into "Product B's" task parameters at 16:07 UTC using an internal employee identity, then submitting code via its web execution endpoint. The recovered custom tool forged risk-control parameters and invoked withdrawals directly — host logs place its execution at 17:49 UTC, 42 minutes before the first verified on-chain transfer. Small test transfers (0.84 ETH, 93 TRX) at 18:31 UTC fell below the risk-control alert threshold; large transfers began 18:58 UTC, with 17 transfers worth ~$360M through 20:09 UTC, and a second wave of 7 transfers (~$28M) between 20:55–21:13 UTC. Bitget's reconciliation system flagged the discrepancy at 19:05 but could not stop in-flight wallet-system commands; signing machines were halted at 21:44 UTC.

Preconditions / Affected

Exploitation required privileged access to third-party security appliances ("Product A"/"Product B," vendor and products unnamed) integrated into Bitget's wallet operations stack; SlowMist states it is still investigating how the attacker moved between the affected systems.

What to do

Bitget's stated remediation: isolated affected servers, revoked/reissued internal credentials, restructured access to sensitive systems, notified the vendor and disabled the affected functionality pending a fix, and is revising its vendor security-assessment process. No patch, CVE, or vendor name is available for other exchanges to act on directly.

Caveats

Neither Mandiant nor SlowMist names the compromised vendor/products, and both reports stop short of fully explaining lateral movement between systems — the mechanism linking appliance compromise to wallet-server control remains undisclosed, limiting what other exchanges can actually check in their own environments.