Bitget's investigation into last week's cryptocurrency theft found that attackers got in through previously unknown vulnerabilities in two third-party security appliances, BleepingComputer reported Wednesday. The exchange now puts the total loss at $387.5 million, above the roughly $351 million first estimated, and says the earliest malicious activity dates to Aug. 31.

What Happened

According to the post-mortem, the attackers stole ETH, XRP, BNB, AVAX, USDT, USDC and other tokens from Bitget's hot and warm wallets, moving funds across Ethereum, the XRP Ledger, Arbitrum, Avalanche, Optimism, BNB Smart Chain, Base and other networks. The Hacker News counted 11 blockchains in all.

Bitget refers to the compromised products only as security appliances A and B and has not named their vendors. Its timeline, as reported by BleepingComputer, runs as follows:

RelatedIsraeli Ad Firm Turned Targeted Ads Into Zero-Click Spyware Delivery, Researchers Say
  • Aug. 31: a service on one of Product A's nodes was hit through a zero-day vulnerability, the first sign of malicious activity.
  • Sept. 23–25: hidden script activity appeared on additional nodes.
  • Sept. 24: the attackers obtained unauthorized privileged access to appliances A and B.
  • Sept. 25: a custom withdrawal tool was launched, and the theft transfers ran for nearly three hours, with the last one at 05:23 UTC+8.

Blockchain security firm SlowMist found that the attackers ran a hidden script under a service process, read an environment variable that held a database password and then connected to the database. Google's Mandiant said the intruders installed a web shell on appliance B, set up a command-and-control channel and used that persistent access to move into the production wallet environment, where they deployed malicious packages. The Hacker News reported that the custom tool bypassed existing risk controls to issue fraudulent withdrawal commands.

Why It Matters

The findings move the story from a wallet compromise to a supply-chain problem. The attackers did not break Bitget's wallet software directly; they went through products bought to protect the network, then spent weeks inside before acting. Because the vendors are unnamed, other exchanges and companies running the same appliances cannot easily tell whether they share the exposure. The Hacker News reported that Bitget notified the vendor and disabled the affected functionality while it waits for security fixes.

The case also shows how long a well-resourced intruder can stay quiet. More than three weeks passed between the first zero-day exploitation and the withdrawals, which were completed in a single overnight window.

Attribution and Recovery

Chief executive Gracy Chen attributed the attack to North Korean hackers, citing IP behavior and on-chain analysis. The Hacker News said Elliptic and TRM Labs found wallet overlaps linking the theft to earlier hacks. Circle, Tether and NEAR Intents have frozen about $632,700 in crypto connected to the theft, a small fraction of the total. Native XRP, one of the stolen assets, has no issuer that can freeze it. Bitget has also opened a recovery bounty program that pays 5% to anyone who helps recover or freeze the stolen assets.

What to Watch

The biggest open question is the identity of the two appliance vendors and whether patches for the zero-days are available. Disclosure would let other users of those products check for the same activity. Further moves by the stolen funds, any new freezes and whether the bounty draws results will show how much of the $387.5 million can be recovered.