An onchain analysis by security firm SlowMist identified the first malicious activity tied to the Bitget breach as occurring on August 31, when an attacker leveraged a zero-day vulnerability in a third-party security product.

The stolen assets were taken from Bitget’s hot wallets on September 24 (UTC), then moved across multiple blockchains to addresses controlled by the attacker. SlowMist’s investigation uncovered two additional third-party security tools and a wallet application that were compromised.

According to the firm’s report, the intruder accessed the database of what it labeled “Product A” after extracting a password from an environment variable. Similar access was later observed on two other nodes on September 23 and September 25. All timestamps are recorded in UTC+8.

On September 25, the attacker gained entry to the management interface of a second security product, which SlowMist called “Product B,” using credentials belonging to an internal employee. The intruder then attempted to run system commands, modify server settings and upload malicious files.

SlowMist noted that its inquiry is ongoing and that it continues to trace how the attacker navigated between compromised systems. The firm also recovered a deleted, highly customized withdrawal tool that was used to manipulate the wallet system’s exit process. The tool altered risk-control parameters, crafted withdrawal requests and triggered the withdrawal function.

Onchain verification showed the earliest confirmed transfer at 2:31 am UTC+8 on September 25, when an address linked to the attacker received 93 TRX, followed 11 seconds later by 0.84 ether on Ethereum. Over the next two hours and 52 minutes, a series of transfers moved funds across several networks, with the final recorded movement at 5:23 am that day.

The attacker also attempted to edit withdrawal records directly in the wallet database and initiate additional Bitcoin withdrawals. Two fabricated Bitcoin withdrawal orders entered processing but returned errors; after reviewing logs and checking order status, the attacker made further attempts.

Bitget’s chief executive, Gracy Chen, told Cointelegraph that the breach originated from a vulnerability in a third-party security product that allowed the attacker to obtain “high-level internal credentials” and issue fraudulent withdrawal commands. She emphasized that Bitget’s private keys and cold‑wallet holdings were not compromised.

Chen added that the exchange is still working to recover the stolen funds and that she is “not very optimistic” about a full recovery, citing the limited restitution achieved after the Bybit hack of 2025 as a cautionary example.

The incident underscores the risks associated with reliance on third‑party security solutions and highlights the need for rigorous audit practices when integrating external products into cryptocurrency exchange infrastructure.