Weekly Research Brief: Bitget Hack, AI Accord and SEC FAQs

What it is

The page adds specifics beyond the postmortem: SlowMist (Bitget's hired forensics firm) traced earliest malicious activity to Aug. 31, recovered a custom withdrawal tool built around Bitget's withdrawal logic, and found multiple "nodes" of Product A infected with malicious code via the zero-day. Two forged BTC withdrawal orders reportedly errored out, which is why the loss wasn't larger — partial-drain behavior the summary doesn't mention.

How it works

The attack targeted the approval/intermediary layer, not key material: forged credentials from the Product A/B zero-day let attackers insert withdrawal commands into Bitget's backend, which signed and processed them like legitimate requests, then the commands were deleted post-execution. The piece frames this as structurally identical to Bybit/Lazarus (Safe{Wallet} UI was doctored so signers approved a disguised transfer) — in both cases the cryptographic signing step worked correctly; the compromise was upstream, in what fed instructions to the signer.

Preconditions / Affected

Relevant to teams running hot/warm wallet withdrawal pipelines integrated with third-party security/custody tooling — any "Product A/B"-style internal security product with high-level credential access to withdrawal logic is a potential single point of failure, since compromising it (not the keys) was sufficient for a full forged-command attack chain.

What to do

Concrete, page-stated response data rather than general advice: NEAR Intents blocked over $50M in attempted laundering flows and froze ~$503,000 mid-execution — contrast with THORChain, which refused Bitget's request to intervene, citing permissionlessness (despite having frozen transactions before). Bitget fully covered the $387.5M loss from its protection fund (backed by Proof-of-Reserve overcollateralization) and has since topped that fund up to $300M. Separately, NEAR Intents' own Omni deposit/withdrawal infrastructure was hit Thursday for ~$3.8M (funds routed to KuCoin then bridged to Bitcoin, flagged by ZachXBT); NEAR says it will fully compensate the loss.

flowchart LR
    A[Zero-day in Product A/B] --> B[Stolen high-level credentials]
    B --> C[Forged withdrawal commands inserted]
    C --> D[Commands processed across 11 chains]
    D --> E[Fraudulent commands deleted]
    D --> F[2 BTC orders errored out]
    F --> G[Loss capped below full drain]

Caveats

Bitget has not named the exploited vendors ("Product A"/"Product B" are forensic labels, not confirmed products); North Korean attribution rests on IP behavior and wallet-overlap analysis from Elliptic/TRM, not independently verified here; the NEAR Intents $3.8M exploit is explicitly unattributed by the source, which states it is "not attributing it either" despite noting the timing coincidence with NEAR's anti-laundering freeze.