Bitget Confirms Third-Party Zero-Day Behind $387.5 Million Cryptocurrency Theft

What it is

SlowMist and Mandiant's technical post-mortem of the Bitget $387.5M heist, confirming the attack chain through two unnamed third-party security products (Product A and Product B) rather than a Bitget-side flaw.

How it works

sequenceDiagram
    participant A as Product A node
    participant B as Product B platform
    participant W as Bitget wallet job server
    A->>A: Aug 31 - hidden script reads<br/>DB password env var
    Note over A: Recurs on 2 more nodes<br/>Sep 23 & Sep 25
    B->>B: Sep 25 - attacker uses stolen<br/>employee identity
    B->>B: 3 attempts: inject commands<br/>into task parameters
    B->>B: Web shell + C2 deployed on<br/>security appliance B
    B->>W: Lateral move via persistent access
    W->>W: 01:49am Sep 25 - custom<br/>withdrawal-drain tool executes
    W->>W: Bypasses risk controls,<br/>drains hot/warm wallets

The attacker first abused a zero-day in Product A to run a hidden script under the service process, pulling the database password from an environment variable and connecting to the database — this reconnaissance activity recurred on two more nodes on Sept 23 and 25, meaning the environment was already compromised before any funds moved. Separately, on Sept 25, the attacker hijacked an internal employee's identity to reach Product B's management platform, made three consecutive attempts to inject system commands into task parameters, then used the platform's web execution endpoint to modify server configuration, write a communication relay file, and assemble malicious program files. Mandiant traced the pivot: a web shell and C2 channel on appliance B gave persistent access, which was used to move laterally into Bitget's production wallet job server and deploy a custom tool (recovered among deleted files) built specifically against the wallet system's withdrawal logic. That tool began executing at 01:49 a.m. on Sept 25, issuing fraudulent withdrawal commands that bypassed existing risk controls.

Preconditions / Affected

Required Product A/B to be running the vulnerable (zero-day) service version; required valid credentials for at least one internal employee with access to Product B's management platform. Impact spanned 11 blockchains (Ethereum, XRP Ledger, Zcash, TRON, Arbitrum, Optimism, Base, BNB Smart Chain, Avalanche, Algorand, Celestia) and assets including XRP, ETH, USDT, ZEC, ATOM, USDC, USD0, XAUt, BNB, AVAX, TRX, ALGO, TIA.

What to do

Bitget has notified the affected third-party vendor and disabled the vulnerable functionality pending a vendor fix — no patch or product names are yet public, so defenders relying on these specific products have no CVE or version boundary to act on yet. ~$1.1M in stolen assets has been frozen by Circle, Tether, and NEAR Intents, indicating issuer-level freezing is a viable response channel for affected exchanges. Attribution to North Korean actors rests on IP behavior patterns plus on-chain wallet overlaps (Elliptic, TRM Labs) linking proceeds to prior laundering operations — exchanges can use those flagged wallets for transaction screening.

Caveats

Product A and Product B are not named, so there is no actionable CVE or patch reference yet; attribution and the zero-day's exact nature rely on vendor/investigator statements that are still described as "progress reports," not a final root-cause disclosure.