October 01, 2026

The Bitget report: the way in was not the blockchain

Two things happened on September 30 in the same case. SlowMist, together with Mandiant, published an interim report on the theft from Bitget's hot wallets. And on the same day ZachXBT reported that the stolen funds had started moving into a Zcash shielded pool.

Together they show the whole road the money takes — from the point of entry to the point where the public trail ends.

WHAT THE REPORT SAYS (SlowMist's findings, not ours)

The way in was not the blockchain. Two third-party security products and a wallet application host were compromised.

The earliest malicious activity in the logs dates to August 31 — almost a month before the theft. On one node of "Product A" a zero-day was used: a hidden script read the database password from an environment variable and connected to it. Similar activity appeared on two other nodes on September 23 and 25.

On September 25 at 00:07 the attacker entered "Product B"'s management platform using an internal employee's identity and made three consecutive attempts to inject system commands through task parameters.

A separate finding is a recovered withdrawal tool written specifically for this wallet service's logic. It forged risk-control parameters and called the withdrawal process itself.

The first verified transfer came at 02:31 — and it was 93 TRX. Eleven seconds later an address on Ethereum received 0.84 ETH. The whole movement fits into roughly 2 hours 52 minutes.

WHAT WE MEASURED OURSELVES (published 26.09)

34.75M USDT and 12.85M USDC left the attacker's address in 8.5 hours — 49 transfers to 19 wallets. Meanwhile 24,596 ETH did not move at all. The receiving wallets were created 34 minutes after the breach was noticed.

WHAT WE COULD NOT VERIFY

The Zcash figures — about 2,700 ZEC worth roughly $3.8M — are cited to ZachXBT, not presented as our own finding. Every public Zcash source refuses our server: blockchair returns 430, 3xpl returns 403, explorer.zec.rocks does not answer at all. What we could check is the arithmetic: at today's ZEC price of about $1,454, 2,700 coins come to roughly $3.9M. That adds up.

THE LADDER THE MONEY WALKS DOWN

What has an issuer moves first. USDT and USDC can be frozen by a company decision, so they are pushed out immediately and fast.

The ETH sits still. There is no one to freeze it, so there is no hurry.

Then on to where there is no issuer and the public trail ends: a shielded pool.

WHAT FOLLOWS FROM THIS

The entry point was not the blockchain but what stood next to the wallet: two security products and one host. On-chain analysis shows where the money went; it does not show how the house was entered.

And the second thing. The first on-chain sign was 93 TRX — an amount nobody looks at. Monitoring tuned to "large transfers" will miss that first step.

🔎 Check an address and see where the funds went: https://t.me/amlconsensus_bot?start=en

The full report: https://x.com/slowmist_team/status/2105145931645743534