source_4047_lz8gwMF.pdf (298 KB)

SlowMist said its investigation of the Bitget hot-wallet theft found prior compromise activity involving two third-party security products and a wallet application host. The investigation recovered a customized withdrawal tool that forged risk-control parameters and initiated cryptocurrency theft through the wallet system. SlowMist reported that the first verified on-chain transfer occurred at 02:31 UTC+8 on September 25, after the attacker had executed the withdrawal tool at 01:49, and that transfer activity continued across multiple blockchains for nearly three hours.