Key Takeaways
Slowmist traced the primary malicious exercise in Bitget-linked techniques to Aug. 31, 25 days earlier than the theft.An worker identification and a customized withdrawal device let attackers transfer funds for two hours and 52 minutes.Mistrack flagged suspected North Korean scripts on Sept. 30 routing loot by way of CoW Protocol and Chainflip.
The Door Was Open Since August
Bitget introduced within the blockchain safety agency on Sept. 25 to analyze the theft from its sizzling wallets, and the findings, present as of Sept. 29, reshape the timeline. The earliest malicious exercise within the accessible logs dates to Aug. 31, when a service on one node of a third-party safety product, which Slowmist calls “Product A,” was hit by a zero-day vulnerability, which means a software program flaw its vendor didn’t but know existed.
The attacker ran a hidden script, learn an atmosphere variable holding a database password and related to the database. The identical hidden-script exercise confirmed up on two extra nodes on Sept. 23 and Sept. 25, with the report including:
These findings present that the affected service environments had already been compromised earlier than the belongings have been transferred out.
That matches Bitget’s personal clarification that attackers abused a third-party safety product to acquire high-level inner credentials. What Slowmist added is the half no person knew, i.e. how lengthy the intruders had been sitting there.
The Evening of the Theft, Minute by Minute
The report logs each step in UTC+8. Transformed to UTC, the sequence on Sept. 24 runs like this:
16:07 UTC: Utilizing an inner worker’s identification, the attacker entered the administration platform of a second vendor device, “Product B,” and made three straight makes an attempt to inject system instructions. 17:49 UTC: A “extremely personalized withdrawal device,” later recovered from recordsdata the attacker deleted, started executing the theft. It cast risk-control parameters, constructed withdrawal requests and triggered the withdrawal course of itself. 18:31 UTC: The primary verified onchain switch landed, 93 TRX, adopted 11 seconds later by 0.84 ETH. 21:23 UTC: The final compiled switch, about 2 hours and 52 minutes after the primary.
The heaviest stretch got here early, as Arkham Intelligence discovered that $228 million left in simply 18 minutes throughout seven chains, with XRP price about $153 million as the only largest piece. After the transfers began, the attacker additionally tried to rewrite withdrawal data within the pockets database. Two fabricated BTC withdrawal orders returned errors, and the logs present the intruder checking order standing and making an attempt once more.
No non-public keys have been taken, however as a substitute, the attackers tricked the interior approval system into signing off on transfers that appeared respectable.
The Aspect Door By Chainflip
The cash remains to be shifting, with Slowmist founder Cos saying Mistrack’s Trackagent device caught suspected North Korean hackers combining CoW Protocol and Chainflip to launder the funds. Automated scripts place swap orders on CoW Protocol, a decentralized trade (DEX) aggregator, and set the recipient to a pre-configured Chainflip deposit contract. As soon as an order settles, the belongings roll straight right into a cross-chain swap and are available out the opposite aspect as bitcoin.
The irony, nevertheless, is tough to overlook as a result of simply in the future earlier, Chainflip brokers rejected a direct deposit from the identical attackers and despatched the funds again alongside their unique route. Cos warned that Chainflip’s anti-money laundering (AML) and know-your-transaction (KYT) checks lag behind the hackers, whose system splits funds throughout bridges, swaps into bitcoin, mixes it and pivots the second a route closes.
Different doorways have been slammed shut too. Close to Intents blocked most of a $50 million laundering try, letting $166,000 by and freezing $503,000. Earlier flows ran by Thorchain, Uniswap, 1inch Fusion and Stargate, which reopened an previous Thorchain struggle over whether or not impartial protocols ought to police stolen cash.
What Bitget Customers Ought to Nonetheless Know
Bitget says its Consumer Safety Fund, holding greater than $464 million, covers the loss. Withdrawals are coming again in phases, with bitcoin first adopted by ether, USDT after which all different belongings.
The larger query sits exterior Bitget and Slowmist didn’t identify the distributors behind “Product A” and “Product B,” and it says it’s nonetheless understanding how the attacker moved between techniques. North Korea-linked teams stole a file $2 billion in 2025, per Fortune, so any trade working the identical safety stack now has a cause to comb its personal logs again to the top of August.
