SlowMist stated: The Bitget hack began with a zero-day vulnerability discovered on August 31.

Hackers had been inside the exchange’s infrastructure for 25 days before they withdrew funds.

The zero-day vulnerability was in third-party security software—through it, the attackers obtained passwords from environment variables and high-level internal credentials.

Using these credentials, they gained access to the wallet database, falsified risk-control parameters, and employed a custom tool to manipulate withdrawals. Before the main theft, the attackers tested the risk controls with small transfers.

Bitget CEO Grace Chen stated that she is not optimistic about fully recovering the funds, citing the experience of the Bybit hack in 2025—when only a small portion of the stolen funds could be recovered.