Bitget Hack Estimated to Begin Three Weeks Earlier, Costing $388 Million

Timeline of the Attack

According to SlowMist, the earliest signs of malicious activity related to the Bitget hack were detected on August 31, 2023. The fraudulent transfers were identified on September 24, leading to significant losses amounting to nearly $387.5 million. The investigation revealed that the attackers exploited vulnerabilities in third-party security products and a wallet management server.

Method of Attack

The attackers utilized a zero-day vulnerability in a service associated with a security product referred to as "Product A". This allowed them to access a database password through a hidden script. Notably, on the night of September 24-25, they gained access to another security product's administration platform using an employee's credentials, attempting to inject commands and upload malicious files.

Impact on Bitget

The primary tool used by the attackers was designed specifically for Bitget’s withdrawal system, enabling them to execute fraudulent withdrawal requests without needing direct access to private keys. After initiating the transfers, unsuccessful attempts to process fake Bitcoin withdrawals were also recorded. Bitget reported that only certain hot and warm wallets were affected, while cold wallets remained secure.

Recovery Efforts

Bitget claims its protection fund, initially set at $300 million and holding over $464 million before the attack, will cover the losses. The platform assures customers that their balances and self-custody applications are unaffected. However, while transactions are visible on the blockchain, the rapid conversion and movement of stolen assets complicate recovery efforts. Investigations continue to trace the full extent of the breach and the various compromised components involved.